@mitre/hdf-converters 2.5.3 → 2.6.6

package/lib/src/sonarqube-mapper.js

@@ -0,0 +1,196 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SonarQubeMapper = exports.SonarQubeResults = void 0;
+const axios_1 = __importDefault(require("axios"));
+const inspecjs_1 = require("inspecjs");
+const package_json_1 = require("../package.json");
+const base_converter_1 = require("./base-converter");
+const CweNistMapping_1 = require("./mappings/CweNistMapping");
+const OwaspNistMapping_1 = require("./mappings/OwaspNistMapping");
+const IMPACT_MAPPING = new Map([
+    ['blocker', 1.0],
+    ['critical', 0.7],
+    ['major', 0.5],
+    ['minor', 0.3],
+    ['info', 0.0]
+]);
+const CWE_NIST_MAPPING = new CweNistMapping_1.CweNistMapping();
+const OWASP_NIST_MAPPING = new OwaspNistMapping_1.OwaspNistMapping();
+function formatCodeDesc(vulnerability) {
+    const typedVulnerability = vulnerability;
+    if (typedVulnerability.textRange) {
+        const snipHtml = `StartLine: ${typedVulnerability.textRange.startLine}, EndLine: ${typedVulnerability.textRange.endLine}<br>Code:<pre>${typedVulnerability.snip}</pre>`;
+        return `Path:${typedVulnerability.component}:${typedVulnerability.textRange.startLine}:${typedVulnerability.textRange.endLine} ${snipHtml}`;
+    }
+    else {
+        return '';
+    }
+}
+function parseNistTags(issue) {
+    var _a, _b;
+    const tags = [];
+    (_a = issue.sysTags) === null || _a === void 0 ? void 0 : _a.forEach((sysTag) => {
+        if (sysTag.toLowerCase().startsWith('owasp-')) {
+            const identifier = [
+                sysTag.toLowerCase().replace('owasp-', '').toUpperCase()
+            ];
+            tags.push(...OWASP_NIST_MAPPING.nistFilterNoDefault(identifier));
+        }
+    });
+    (_b = issue.summary.match(/CWE-\d\d\d?\d?\d?\d?\d/gi)) === null || _b === void 0 ? void 0 : _b.forEach((match) => {
+        tags.push(...CWE_NIST_MAPPING.nistFilter(match.split('-')[1]));
+    });
+    return tags;
+}
+class SonarQubeResults {
+    constructor(sonarQubeHost, projectId, userToken) {
+        this.data = {
+            issues: []
+        };
+        this.sonarQubeHost = '';
+        this.projectId = '';
+        this.userToken = '';
+        this.sonarQubeHost = sonarQubeHost;
+        this.projectId = projectId;
+        this.userToken = userToken;
+    }
+    async toHdf() {
+        return this.getProjectData();
+    }
+    async getProjectData() {
+        var _a, _b;
+        let paging = true;
+        let page = 1;
+        while (paging) {
+            await axios_1.default
+                .get(`${this.sonarQubeHost}/api/issues/search`, {
+                auth: { username: this.userToken, password: '' },
+                params: {
+                    componentKeys: this.projectId,
+                    types: 'VULNERABILITY',
+                    p: page
+                }
+            })
+                .then(({ data }) => {
+                var _a;
+                if (data.issues) {
+                    this.data.issues.push(...data.issues);
+                }
+                paging = ((_a = data.paging) === null || _a === void 0 ? void 0 : _a.total) === 100;
+                page += 1;
+            });
+        }
+        let requests = [];
+        (_a = this.data.issues) === null || _a === void 0 ? void 0 : _a.forEach((issue) => {
+            requests.push(axios_1.default.get(`${this.sonarQubeHost}/api/sources/raw`, {
+                auth: { username: this.userToken, password: '' },
+                params: {
+                    key: issue.component
+                }
+            }));
+        });
+        await axios_1.default.all(requests).then(axios_1.default.spread((...responses) => {
+            responses.forEach((response, index) => {
+                var _a, _b;
+                this.data.issues[index].snip = response.data
+                    .split('\n')
+                    .slice(((_a = this.data.issues[index].textRange) === null || _a === void 0 ? void 0 : _a.startLine) - 3, ((_b = this.data.issues[index].textRange) === null || _b === void 0 ? void 0 : _b.endLine) + 3)
+                    .join('\n');
+            });
+        }));
+        requests = [];
+        (_b = this.data.issues) === null || _b === void 0 ? void 0 : _b.forEach((issue) => {
+            requests.push(axios_1.default.get(`${this.sonarQubeHost}/api/rules/show`, {
+                auth: { username: this.userToken, password: '' },
+                params: {
+                    key: issue.rule
+                }
+            }));
+        });
+        await axios_1.default.all(requests).then(axios_1.default.spread((...responses) => {
+            responses.forEach((response, index) => {
+                this.data.issues[index].sysTags = response.data.rule.sysTags;
+                this.data.issues[index].name = response.data.rule.name;
+                this.data.issues[index].summary = response.data.rule.htmlDesc;
+            });
+        }));
+        const result = new SonarQubeMapper(this.data, this.projectId);
+        return result.toHdf();
+    }
+    setMappings(customMapping) {
+        this.customMapping = customMapping;
+    }
+}
+exports.SonarQubeResults = SonarQubeResults;
+class SonarQubeMapper extends base_converter_1.BaseConverter {
+    constructor(issuesJSON, projectName) {
+        super(issuesJSON);
+        this.projectName = '';
+        this.mappings = {
+            platform: {
+                name: 'Heimdall Tools',
+                release: package_json_1.version,
+                target_id: this.projectName
+            },
+            version: package_json_1.version,
+            statistics: {
+                duration: null
+            },
+            profiles: [
+                {
+                    name: 'Sonarqube Scan',
+                    version: '',
+                    title: `SonarQube Scan of Project ${this.projectName}`,
+                    maintainer: null,
+                    summary: `SonarQube Scan of Project ${this.projectName}`,
+                    license: null,
+                    copyright: null,
+                    copyright_email: null,
+                    supports: [],
+                    attributes: [],
+                    depends: [],
+                    groups: [],
+                    status: 'loaded',
+                    controls: [
+                        {
+                            path: 'issues',
+                            key: 'id',
+                            desc: { path: 'summary' },
+                            descriptions: [],
+                            refs: [],
+                            source_location: {},
+                            id: { path: 'rule' },
+                            title: { path: 'name' },
+                            impact: {
+                                path: 'severity',
+                                transformer: (0, base_converter_1.impactMapping)(IMPACT_MAPPING)
+                            },
+                            code: null,
+                            tags: {
+                                nist: { transformer: parseNistTags }
+                            },
+                            results: [
+                                {
+                                    status: inspecjs_1.ExecJSON.ControlResultStatus.Failed,
+                                    code_desc: { transformer: formatCodeDesc },
+                                    run_time: 0,
+                                    start_time: ''
+                                }
+                            ]
+                        }
+                    ],
+                    sha256: ''
+                }
+            ]
+        };
+        this.projectName = projectName;
+    }
+    setMappings(customMappings) {
+        super.setMappings(customMappings);
+    }
+}
+exports.SonarQubeMapper = SonarQubeMapper;
+//# sourceMappingURL=sonarqube-mapper.js.map

package/lib/src/sonarqube-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sonarqube-mapper.js","sourceRoot":"","sources":["../../src/sonarqube-mapper.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA2C;AAC3C,uCAAkC;AAClC,kDAAgE;AAChE,qDAK0B;AAC1B,8DAAyD;AACzD,kEAA6D;AAyC7D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,CAAC,SAAS,EAAE,GAAG,CAAC;IAChB,CAAC,UAAU,EAAE,GAAG,CAAC;IACjB,CAAC,OAAO,EAAE,GAAG,CAAC;IACd,CAAC,OAAO,EAAE,GAAG,CAAC;IACd,CAAC,MAAM,EAAE,GAAG,CAAC;CACd,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,+BAAc,EAAE,CAAC;AAC9C,MAAM,kBAAkB,GAAG,IAAI,mCAAgB,EAAE,CAAC;AAElD,SAAS,cAAc,CAAC,aAAsB;IAC5C,MAAM,kBAAkB,GAAG,aAI1B,CAAC;IACF,IAAI,kBAAkB,CAAC,SAAS,EAAE;QAChC,MAAM,QAAQ,GAAG,cAAc,kBAAkB,CAAC,SAAS,CAAC,SAAS,cAAc,kBAAkB,CAAC,SAAS,CAAC,OAAO,iBAAiB,kBAAkB,CAAC,IAAI,QAAQ,CAAC;QACxK,OAAO,QAAQ,kBAAkB,CAAC,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;KAC7I;SAAM;QACL,OAAO,EAAE,CAAC;KACX;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAY;;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAA,KAAK,CAAC,OAAO,0CAAE,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;YAC7C,MAAM,UAAU,GAAG;gBACjB,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;aACzD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;SAClE;IACH,CAAC,CAAC,CAAC;IAEH,MAAA,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,0CAAE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjE,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAa,gBAAgB;IAQ3B,YAAY,aAAqB,EAAE,SAAiB,EAAE,SAAiB;QAPvE,SAAI,GAAc;YAChB,MAAM,EAAE,EAAE;SACX,CAAC;QACF,kBAAa,GAAG,EAAE,CAAC;QACnB,cAAS,GAAG,EAAE,CAAC;QACf,cAAS,GAAG,EAAE,CAAC;QAGb,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc;;QAElB,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,MAAM,EAAE;YACb,MAAM,eAAK;iBACR,GAAG,CAAY,GAAG,IAAI,CAAC,aAAa,oBAAoB,EAAE;gBACzD,IAAI,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAC;gBAC9C,MAAM,EAAE;oBACN,aAAa,EAAE,IAAI,CAAC,SAAS;oBAC7B,KAAK,EAAE,eAAe;oBACtB,CAAC,EAAE,IAAI;iBACR;aACF,CAAC;iBACD,IAAI,CAAC,CAAC,EAAC,IAAI,EAAC,EAAE,EAAE;;gBACf,IAAI,IAAI,CAAC,MAAM,EAAE;oBACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;iBACvC;gBACD,MAAM,GAAG,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,KAAK,MAAK,GAAG,CAAC;gBACpC,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;SACN;QAED,IAAI,QAAQ,GAA6B,EAAE,CAAC;QAC5C,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,0CAAE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAClC,QAAQ,CAAC,IAAI,CACX,eAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,kBAAkB,EAAE;gBACjD,IAAI,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAC;gBAC9C,MAAM,EAAE;oBACN,GAAG,EAAE,KAAK,CAAC,SAAS;iBACrB;aACF,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,eAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5B,eAAK,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,EAAE;YAE5B,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;;gBACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI;qBACzC,KAAK,CAAC,IAAI,CAAC;qBACX,KAAK,CACJ,CAAC,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,0CAAE,SAAoB,IAAG,CAAC,EAE5D,CAAC,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,0CAAE,OAAkB,IAAG,CAAC,CAC3D;qBACA,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,GAAG,EAAE,CAAC;QACd,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,0CAAE,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAClC,QAAQ,CAAC,IAAI,CACX,eAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,iBAAiB,EAAE;gBAChD,IAAI,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAC;gBAC9C,MAAM,EAAE;oBACN,GAAG,EAAE,KAAK,CAAC,IAAI;iBAChB;aACF,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,eAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5B,eAAK,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,EAAE;YAC5B,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,WAAW,CACT,aAA+D;QAE/D,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AAlGD,4CAkGC;AAED,MAAa,eAAgB,SAAQ,8BAAa;IAEhD,YAAY,UAAqB,EAAE,WAAmB;QACpD,KAAK,CAAC,UAAiC,CAAC,CAAC;QAF3C,gBAAW,GAAG,EAAE,CAAC;QAKjB,aAAQ,GAAqD;YAC3D,QAAQ,EAAE;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,sBAAoB;gBAC7B,SAAS,EAAE,IAAI,CAAC,WAAW;aAC5B;YACD,OAAO,EAAE,sBAAoB;YAC7B,UAAU,EAAE;gBACV,QAAQ,EAAE,IAAI;aACf;YACD,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,EAAE;oBACX,KAAK,EAAE,6BAA6B,IAAI,CAAC,WAAW,EAAE;oBACtD,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,6BAA6B,IAAI,CAAC,WAAW,EAAE;oBACxD,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,IAAI;oBACrB,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,QAAQ;4BACd,GAAG,EAAE,IAAI;4BACT,IAAI,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC;4BACvB,YAAY,EAAE,EAAE;4BAChB,IAAI,EAAE,EAAE;4BACR,eAAe,EAAE,EAAE;4BACnB,EAAE,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BAClB,KAAK,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC;4BACrB,MAAM,EAAE;gCACN,IAAI,EAAE,UAAU;gCAChB,WAAW,EAAE,IAAA,8BAAa,EAAC,cAAc,CAAC;6BAC3C;4BACD,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE;gCACJ,IAAI,EAAE,EAAC,WAAW,EAAE,aAAa,EAAC;6BACnC;4BACD,OAAO,EAAE;gCACP;oCACE,MAAM,EAAE,mBAAQ,CAAC,mBAAmB,CAAC,MAAM;oCAC3C,SAAS,EAAE,EAAC,WAAW,EAAE,cAAc,EAAC;oCACxC,QAAQ,EAAE,CAAC;oCACX,UAAU,EAAE,EAAE;iCACf;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE,EAAE;iBACX;aACF;SACF,CAAC;QA1DA,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IA0DD,WAAW,CACT,cAAgE;QAEhE,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AApED,0CAoEC"}