Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature 606 provide zap and improve report format #947

Merged
merged 38 commits into from Feb 14, 2022
Merged

Feature 606 provide zap and improve report format #947

merged 38 commits into from Feb 14, 2022

Conversation

de-jcup
Copy link
Member

@de-jcup de-jcup commented Jan 17, 2022 •
edited

@de-jcup
Implementation web request and response for sereco #606
9aa1be9 
- implemented web data parts (request and response)
- changed toString and hashCode + equals implementations
- enhanced assert object for vulnerabilities
- changed also importerToTest to non static but normal field
  so having no side effects inside tests
- added tests
@de-jcup
Implementing SARIF web parts #606 and fix #946
2bdef29
@de-jcup
Improve report format with web scan data #606
6527fb5 
- dropped some unused parts from sechub finding
  (website, method, ...O)
- introduced new web json element
- sereco web data now transformed to sechub report web element
- added some overall tests (see Sarif2Sereco2SecHubReportTest)
  which are very fast. We already test if sarif reporting works
  generally in existing integration tests.
@de-jcup
Provide field "solution" inside sereco and sechub report #948
1bea7c0 
- renamed old,but unused, field/getters/setters from "resolution"
  to "solution"
- sereco product transformer now transforms "solution" also into
  sechub report
@de-jcup
Changed title of folding #950
a3c7ef5 
- changed from "Open/Close Callstack" to "Open/Close details"
@de-jcup
Added description to code scan report details #950
ee409c0 
- fixed small bug #951
- Provide now a TestUtilmethod to create temporary files located
  inside "build/sechub/tmp/**" #651
- created ThymeLeafHTMLReportingTest to simplify HTML report designing:
  It uses real origin product data and generates HTML test output
  without a running SecHub server. Testfile names are fix and do not
  change
@de-jcup
added initial webscan details to report #606
241ed7a
@de-jcup
Web report template output style now final #606
15e1a48 
- improved output for web report data inside report
@de-jcup de-jcup force-pushed the feature-606-provide-zap-and-improve-report-format branch from 27ffe4e to 15e1a48 Compare January 25, 2022 14:20
@de-jcup
Improved reporting #606
5a202f2 
- checkmarx thymeleaf example4 added
- separated more thymeleaf fragements + created new fragement files
- fallback messages (solution,description) implemented for #955
@de-jcup
Improved documentation and implementaiton #949, #606
21a4826 
- Improved false-positive documentation #949
- Introduced target URL #606
@de-jcup
Fix failing tests #606
67e4c45
@de-jcup
Added project scan configuration to techdoc #949
f7c07e8
@de-jcup
Some documenttion enhancements #949
afae649 
- Renamed asciidoc file to clarify content
- purged unnecessary plantuml title
- improved figure description
- dropped accidently added png
@de-jcup
False posittive definition phase works for web scans #606
1214811 
- refactored false positive merger: separated meta data creation
  into own factory class
- wrote tests
- adopted tests
@de-jcup
Fixed failing build 606
c6427d4 
- improved PojoTester error output
- purged duplicated test
- SarifObject final method modifier removed, because
  mocking does not work this way
@de-jcup
Refactoring. dropped URL in sereco findings #606
0f7a7da 
- we have now web attribute and so dropped field url and it
  setters, getters. same for assert methods
- implemented netsparker url setting in new way
  (but only target url as before)
@de-jcup
Fixed failing unit tests #606
a63d2ce 
- example json has been moved so one test failed. fixed path
- property bags are optional and can be null. The old implementations
  (before SarifObject) did some fallback mechanism. But to handle the
  optional part and also to keep getter/setter stupid, SarifObject
  just returns null when not defined. So upated teste
- moved test of null handling of property bag key value combinations
  from ResultTest to PropertyBagTest
@de-jcup
Fix broken tests #606
ff4ef14
@de-jcup
After changes brakeman description text used - fixed test #606
0a1c085 
- after the changes on SARIF handling the brakeman result
  descriptions are used now instead of the generic rule
  descriptions. So the test failed
- The result description are superior to the generic ones, so
  the handling is now better
- Adopted test
@de-jcup
Fix failing PDS integration test #606
509a6ce 
- same as in former junit test: the description for brakeman
  is now containing the dedicated description instead the generic
  one. So okay and changed test
@de-jcup
Fixed problem in sereco result transfomer test #606
5302320 
- fixed problem by handling scan type being null
- improved TestAPI, introduced test sechub job status object
- changed TestAPI.waitForJobDone so when job is failed
  the check will immediately break the test. So faster response
  with better output what was the real problem.
@de-jcup
Added webscan strategy usage into finder and added test #606
c4ac871
@de-jcup
Added UNKNOWN enum element to PDS scan type as well #606
84deaf4 
- keep PDS scan type and SecHub scan types in sync
@de-jcup
Improved implementation and testing of fp strategy for web scans #606
e08b591
@de-jcup
Restart test do still need "retry on failing" #606
05df581 
- one restart integration test did fail
- the others restart integration tests could be flaky when not
  explicit allowing to fail in the meantime
- added additional parameter 'jobMayNeverFail' where
  caller can define if job failing is allowed or not in meantime
- introduced 2 new methods to handle this convinient inside
  tests
- changed TestExecutable and AbstractTestExecutable: the former
  run and runImpl methods had wrong javadoc and also it was not clear
  what the resulting boolean stood for
@de-jcup
Added test and implementation form attack, target, evicende #606
df4ac90
@de-jcup
Fixed failing code strategy test #606
43704da
@de-jcup
Added method tests #606
071988e
@de-jcup
Scenario 9 integration test does check fp for websans now as well #606
1f9edec
@de-jcup
Minor changes #606
1c82fd7 
- comments changed
- javadoc added/improved
- fixed sechub repot web equals/hashCode impl
- made some fields private
- dropped unnecessary injections
@de-jcup
Fixed typos
a2ec4ea 
- "positve" to "positive" #606
- "evicence" to "evidence"
@de-jcup
Renamed *positve* to *positive* #606
5caef06
@de-jcup de-jcup requested a review from Jeeppler February 4, 2022 15:30
@de-jcup de-jcup marked this pull request as ready for review February 4, 2022 15:30
Jeeppler
Jeeppler requested changes Feb 4, 2022
View reviewed changes
Copy link
Member

@Jeeppler Jeeppler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comments.

...b-commons-core/src/test/java/com/daimler/sechub/commons/core/util/SimpleStringUtilsTest.java Outdated Show resolved Hide resolved
...ommons-model/src/main/java/com/daimler/sechub/commons/model/web/SecHubReportWebResponse.java Show resolved Hide resolved
sechub-commons-model/src/test/java/com/daimler/sechub/commons/model/SecHubFindingTest.java Show resolved Hide resolved
sechub-doc/src/docs/asciidoc/documents/shared/concepts/concept_falsepositive_handling.adoc Outdated Show resolved Hide resolved
sechub-doc/src/docs/asciidoc/documents/shared/concepts/concept_falsepositive_handling.adoc Outdated Show resolved Hide resolved
sechub-scan/src/main/resources/templates/report/html/fragments.html Outdated Show resolved Hide resolved
sechub-scan/src/main/resources/templates/report/html/headers.html Outdated Show resolved Hide resolved
sechub-scan/src/main/resources/templates/report/html/headers.html Outdated Show resolved Hide resolved
sechub-sereco/src/main/java/com/daimler/sechub/sereco/importer/SarifV1JSONImporter.java Show resolved Hide resolved
sechub-sereco/src/main/java/com/daimler/sechub/sereco/metadata/SerecoVulnerability.java Outdated Show resolved Hide resolved
@de-jcup
Review changes #606
de27584 
- fixed test
- changed tests to parametrized
- added junit params for commons sub project testing
- improved documentation
@de-jcup
Applied review changes #606
0deb4f5 
- html formatted
- removed unnecessary/duplicated parts from documentation
- updated documentation
- handled grammar issues
@de-jcup
Added review changes #606, implemented #990
0ba5cce 
- changed html styles to dedicated css classes
- changed css styling so HTML report uses full width where possible
@de-jcup
Added review changes #606
93f70f5 
- updated documentation
- fixed typos
- updated comments
@de-jcup
Merge branch 'develop' into feature branch
fd7fd91 
# Conflicts:
#	libraries.gradle
Jeeppler
Jeeppler requested changes Feb 11, 2022
View reviewed changes
Copy link
Member

@Jeeppler Jeeppler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall it looks good. However, I still found a few small issues. Please have a look at the comments.

sechub-commons-model/build.gradle Outdated Show resolved Hide resolved
sechub-commons-model/build.gradle Outdated Show resolved Hide resolved
...n/java/com/daimler/sechub/domain/scan/product/sereco/SerecoFalsePositiveWebScanStrategy.java Outdated Show resolved Hide resolved
sechub-scan/src/main/resources/templates/report/html/fragments.html Outdated Show resolved Hide resolved
@de-jcup
Review changes #606
d803cfb 
- fixed typos
- dropped manufactor dependant css
Jeeppler
Jeeppler approved these changes Feb 14, 2022
View reviewed changes
Copy link
Member

@Jeeppler Jeeppler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@de-jcup de-jcup merged commit a3bdbb4 into develop Feb 14, 2022
@de-jcup de-jcup deleted the feature-606-provide-zap-and-improve-report-format branch February 14, 2022 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Jeeppler Jeeppler Jeeppler approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@de-jcup @Jeeppler