Skip to content

Commit 6508716

Browse files
marwin1991marwin1991
authored
Merge pull request #47 from angrymeir/suppresions-by-id
suppressing by id
2 parents 2c30546 + f6047c0 commit 6508716

10 files changed

Lines changed: 358 additions & 156 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,7 @@ sast:
145145
value: "2555"
146146
- type: "find_sec_bugs_type"
147147
value: "SPRING_ENDPOINT"
148+
- id: "db914ce5737b49650ae650fc3b0fe38a531eadd8ea780f48a013419c4adec7f0"
148149
```
149150

150151
And now you can modify execution commands as follows:

‎poetry.lock‎

Lines changed: 100 additions & 117 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ python = "^3.10"
1616
junit-xml = "^1.9"
1717
PyYAML = "^6.0"
1818
pytest = "^7.2.0"
19+
setuptools = "^75.5.0"
1920

2021
[tool.poetry.dev-dependencies]
2122

‎secscanner2junit/config.py‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,22 @@
22

33

44
class Suppression:
5-
def __init__(self, type, value):
5+
6+
def __init__(self,
7+
id: str | None = None,
8+
type: str | None = None,
9+
value: str | None = None):
10+
self.id = id
611
self.type = type
712
self.value = value
813

914
def __repr__(self):
10-
return f"Suppression(type={self.type}, value={self.value})"
15+
return f"Suppression(id={self.id}, type={self.type}, value={self.value})"
1116

1217
def __eq__(self, other):
1318
if isinstance(other, Suppression):
19+
if self.id is not None:
20+
return self.id == other.id
1421
return self.type == other.type and self.value == other.value
1522

1623
return False
@@ -36,9 +43,17 @@ def __is_identifier_suppressed(self, identifier):
3643
return False
3744

3845
def __is_vulnerability_suppressed(self, vulnerability):
39-
for identifier in vulnerability['identifiers']:
40-
if self.__is_identifier_suppressed(identifier):
41-
return True
46+
for suppression in self.suppressions:
47+
if suppression is None:
48+
return False
49+
50+
if suppression.id is not None:
51+
return suppression.id == vulnerability['id']
52+
53+
for identifier in vulnerability['identifiers']:
54+
if suppression.type == identifier['type'] and suppression.value == identifier['value']:
55+
return True
56+
4257
return False
4358

4459
def suppress(self, vulnerabilities):
@@ -91,6 +106,15 @@ def __get_suppressions(sast_yml_dict):
91106

92107
def __get_suppression(suppression_yml_dict):
93108
try:
94-
return Suppression(suppression_yml_dict['type'], suppression_yml_dict['value'])
109+
return Suppression(__get_suppression_field(suppression_yml_dict, 'id'),
110+
__get_suppression_field(suppression_yml_dict, 'type'),
111+
__get_suppression_field(suppression_yml_dict, 'value'))
112+
except KeyError:
113+
return None
114+
115+
116+
def __get_suppression_field(suppression_yml_dict, key):
117+
try:
118+
return suppression_yml_dict[key]
95119
except KeyError:
96120
return None

‎tests/resources/test_sast/test_basic/gl-sast-report.json‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@
77
"name": "Spring CSRF unrestricted RequestMapping",
88
"message": "Spring CSRF unrestricted RequestMapping",
99
"description": "Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks",
10-
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
10+
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
1111
"severity": "Medium",
1212
"confidence": "High",
1313
"scanner": {
1414
"id": "find_sec_bugs",
1515
"name": "Find Security Bugs"
1616
},
1717
"location": {
18-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
18+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
1919
"start_line": 23,
20-
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
20+
"class": "pl.com.abc.example.springbootabcexample.PingController",
2121
"method": "ping"
2222
},
2323
"identifiers": [
@@ -40,18 +40,18 @@
4040
"category": "sast",
4141
"name": "Found Spring endpoint",
4242
"message": "Found Spring endpoint",
43-
"description": "pl.com.softnet.example.springbootsoftnetexample.PingController is a Spring endpoint (Controller)",
44-
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
43+
"description": "pl.com.abc.example.springbootabcexample.PingController is a Spring endpoint (Controller)",
44+
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
4545
"severity": "Low",
4646
"confidence": "Low",
4747
"scanner": {
4848
"id": "find_sec_bugs",
4949
"name": "Find Security Bugs"
5050
},
5151
"location": {
52-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
52+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
5353
"start_line": 23,
54-
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
54+
"class": "pl.com.abc.example.springbootabcexample.PingController",
5555
"method": "ping"
5656
},
5757
"identifiers": [
@@ -68,18 +68,18 @@
6868
"category": "sast",
6969
"name": "Found Spring endpoint",
7070
"message": "Found Spring endpoint",
71-
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
72-
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:16",
71+
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
72+
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:16",
7373
"severity": "Low",
7474
"confidence": "Low",
7575
"scanner": {
7676
"id": "find_sec_bugs",
7777
"name": "Find Security Bugs"
7878
},
7979
"location": {
80-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
80+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
8181
"start_line": 16,
82-
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
82+
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
8383
"method": "getDomainError"
8484
},
8585
"identifiers": [
@@ -97,17 +97,17 @@
9797
"name": "HTTP headers untrusted",
9898
"message": "HTTP headers untrusted",
9999
"description": "Request header can easily be altered by the client",
100-
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:50",
100+
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:50",
101101
"severity": "Low",
102102
"confidence": "Low",
103103
"scanner": {
104104
"id": "find_sec_bugs",
105105
"name": "Find Security Bugs"
106106
},
107107
"location": {
108-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
108+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
109109
"start_line": 50,
110-
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController$IpAddressUtils",
110+
"class": "pl.com.abc.example.springbootabcexample.PingController$IpAddressUtils",
111111
"method": "getIpAddressFromRequest"
112112
},
113113
"identifiers": [
@@ -124,18 +124,18 @@
124124
"category": "sast",
125125
"name": "Found Spring endpoint",
126126
"message": "Found Spring endpoint",
127-
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
128-
"cve": "8e968b3dea7c8b68b43c07ab9b37c120:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:11",
127+
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
128+
"cve": "8e968b3dea7c8b68b43c07ab9b37c120:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:11",
129129
"severity": "Low",
130130
"confidence": "Low",
131131
"scanner": {
132132
"id": "find_sec_bugs",
133133
"name": "Find Security Bugs"
134134
},
135135
"location": {
136-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
136+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
137137
"start_line": 11,
138-
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
138+
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
139139
"method": "getSomeFakeError"
140140
},
141141
"identifiers": [

‎tests/resources/test_sast/test_sast_suppression/gl-sast-report-many-with-same-name.json‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@
77
"name": "Spring CSRF unrestricted RequestMapping",
88
"message": "Spring CSRF unrestricted RequestMapping",
99
"description": "Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks",
10-
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
10+
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
1111
"severity": "Medium",
1212
"confidence": "High",
1313
"scanner": {
1414
"id": "find_sec_bugs",
1515
"name": "Find Security Bugs"
1616
},
1717
"location": {
18-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
18+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
1919
"start_line": 23,
20-
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
20+
"class": "pl.com.abc.example.springbootabcexample.PingController",
2121
"method": "ping"
2222
},
2323
"identifiers": [
@@ -40,18 +40,18 @@
4040
"category": "sast",
4141
"name": "Found Spring endpoint",
4242
"message": "Found Spring endpoint",
43-
"description": "pl.com.softnet.example.springbootsoftnetexample.PingController is a Spring endpoint (Controller)",
44-
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
43+
"description": "pl.com.abc.example.springbootabcexample.PingController is a Spring endpoint (Controller)",
44+
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
4545
"severity": "Low",
4646
"confidence": "Low",
4747
"scanner": {
4848
"id": "find_sec_bugs",
4949
"name": "Find Security Bugs"
5050
},
5151
"location": {
52-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
52+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
5353
"start_line": 23,
54-
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
54+
"class": "pl.com.abc.example.springbootabcexample.PingController",
5555
"method": "ping"
5656
},
5757
"identifiers": [
@@ -68,18 +68,18 @@
6868
"category": "sast",
6969
"name": "Found Spring endpoint",
7070
"message": "Found Spring endpoint",
71-
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
72-
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:16",
71+
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
72+
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:16",
7373
"severity": "Low",
7474
"confidence": "Low",
7575
"scanner": {
7676
"id": "find_sec_bugs",
7777
"name": "Find Security Bugs"
7878
},
7979
"location": {
80-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
80+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
8181
"start_line": 16,
82-
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
82+
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
8383
"method": "getDomainError"
8484
},
8585
"identifiers": [
@@ -97,17 +97,17 @@
9797
"name": "HTTP headers untrusted",
9898
"message": "HTTP headers untrusted",
9999
"description": "Request header can easily be altered by the client",
100-
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:50",
100+
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:50",
101101
"severity": "Low",
102102
"confidence": "Low",
103103
"scanner": {
104104
"id": "find_sec_bugs",
105105
"name": "Find Security Bugs"
106106
},
107107
"location": {
108-
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
108+
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
109109
"start_line": 50,
110-
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController$IpAddressUtils",
110+
"class": "pl.com.abc.example.springbootabcexample.PingController$IpAddressUtils",
111111
"method": "getIpAddressFromRequest"
112112
},
113113
"identifiers": [

0 commit comments

Comments
 (0)