-
Notifications
You must be signed in to change notification settings - Fork 38
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add converter for Dependency-Track FPF files * Linting fixes * Update test files for latest mapper update * Update test files * sonarqube says that these ought to be readonly Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * added checkinput step, made output formatted, transitioned to using the extension of of basecommand, fixed help text Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * updated readme Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * remove unused import Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * fixed indentation in readme Signed-off-by: Amndeep Singh Mann <amann@mitre.org> --------- Signed-off-by: Amndeep Singh Mann <amann@mitre.org> Co-authored-by: Jace Barayuga <jbarayuga@referentia.com>
- Loading branch information
Showing
15 changed files
with
14,629 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| import {Flags} from '@oclif/core' | ||
| import fs from 'fs' | ||
| import {DependencyTrackMapper as Mapper} from '@mitre/hdf-converters' | ||
| import {checkInput, checkSuffix} from '../../utils/global' | ||
| import {BaseCommand} from '../../utils/oclif/baseCommand' | ||
|
|
||
| export default class DependencyTrack2HDF extends BaseCommand<typeof DependencyTrack2HDF> { | ||
| static readonly usage = '<%= command.id %> -i <dt-fpf-json> -o <hdf-scan-results-json> [-h] [-w]' | ||
|
|
||
| static readonly description = 'Translate a Dependency-Track results JSON file into a Heimdall Data Format JSON file' | ||
|
|
||
| static readonly examples = ['<%= config.bin %> <%= command.id %> -i dt-fpf.json -o output-hdf-name.json'] | ||
|
|
||
| static readonly flags = { | ||
| input: Flags.string({char: 'i', required: true, description: 'Input Dependency-Track FPF file'}), | ||
| output: Flags.string({char: 'o', required: true, description: 'Output HDF file'}), | ||
| 'with-raw': Flags.boolean({char: 'w', required: false}), | ||
| } | ||
|
|
||
| async run() { | ||
| const {flags} = await this.parse(DependencyTrack2HDF) | ||
| const data = fs.readFileSync(flags.input, 'utf8') | ||
| checkInput( | ||
| {data, filename: flags.input}, | ||
| 'dependencyTrack', | ||
| 'Dependency-Track results JSON', | ||
| ) | ||
|
|
||
| const converter = new Mapper(data, flags['with-raw']) | ||
| fs.writeFileSync(checkSuffix(flags.output), JSON.stringify(converter.toHdf(), null, 2)) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,186 @@ | ||
| import {expect, test} from '@oclif/test' | ||
| import tmp from 'tmp' | ||
| import path from 'path' | ||
| import fs from 'fs' | ||
| import {omitHDFChangingFields} from '../utils' | ||
|
|
||
| describe('Test Dependency-Track', () => { | ||
| const tmpobj = tmp.dirSync({unsafeCleanup: true}) | ||
|
|
||
| test | ||
| .stdout() | ||
| .command([ | ||
| 'convert dependency_track2hdf', | ||
| '-i', | ||
| path.resolve( | ||
| './test/sample_data/dependency_track/sample_input_report/fpf-default.json', | ||
| ), | ||
| '-o', | ||
| `${tmpobj.name}/dependencytracktest.json`, | ||
| ]) | ||
| .it('hdf-converter output test', () => { | ||
| const converted = JSON.parse( | ||
| fs.readFileSync(`${tmpobj.name}/dependencytracktest.json`, 'utf8'), | ||
| ) | ||
| const sample = JSON.parse( | ||
| fs.readFileSync( | ||
| path.resolve('./test/sample_data/dependency_track/hdf-default.json'), | ||
| 'utf8', | ||
| ), | ||
| ) | ||
| expect(omitHDFChangingFields(converted)).to.eql( | ||
| omitHDFChangingFields(sample), | ||
| ) | ||
| }) | ||
| }) | ||
|
|
||
| describe('Test Dependency-Track withraw flag', () => { | ||
| const tmpobj = tmp.dirSync({unsafeCleanup: true}) | ||
|
|
||
| test | ||
| .stdout() | ||
| .command([ | ||
| 'convert dependency_track2hdf', | ||
| '-i', | ||
| path.resolve( | ||
| './test/sample_data/dependency_track/sample_input_report/fpf-default.json', | ||
| ), | ||
| '-o', | ||
| `${tmpobj.name}/dependencytracktest.json`, | ||
| '-w', | ||
| ]) | ||
| .it('hdf-converter withraw output test', () => { | ||
| const converted = JSON.parse( | ||
| fs.readFileSync(`${tmpobj.name}/dependencytracktest.json`, 'utf8'), | ||
| ) | ||
| const sample = JSON.parse( | ||
| fs.readFileSync( | ||
| path.resolve('./test/sample_data/dependency_track/hdf-default-withraw.json'), | ||
| 'utf8', | ||
| ), | ||
| ) | ||
| expect(omitHDFChangingFields(converted)).to.eql( | ||
| omitHDFChangingFields(sample), | ||
| ) | ||
| }) | ||
| }) | ||
|
|
||
| describe('Test Dependency-Track optional attributes (e.g. vulnerability.cwes, analysis.state, etc.)', () => { | ||
| const tmpobj = tmp.dirSync({unsafeCleanup: true}) | ||
|
|
||
| test | ||
| .stdout() | ||
| .command([ | ||
| 'convert dependency_track2hdf', | ||
| '-i', | ||
| path.resolve( | ||
| './test/sample_data/dependency_track/sample_input_report/fpf-optional-attributes.json', | ||
| ), | ||
| '-o', | ||
| `${tmpobj.name}/dependencytracktest.json`, | ||
| ]) | ||
| .it('hdf-converter output test', () => { | ||
| const converted = JSON.parse( | ||
| fs.readFileSync(`${tmpobj.name}/dependencytracktest.json`, 'utf8'), | ||
| ) | ||
| const sample = JSON.parse( | ||
| fs.readFileSync( | ||
| path.resolve('./test/sample_data/dependency_track/hdf-optional-attributes.json'), | ||
| 'utf8', | ||
| ), | ||
| ) | ||
| expect(omitHDFChangingFields(converted)).to.eql( | ||
| omitHDFChangingFields(sample), | ||
| ) | ||
| }) | ||
| }) | ||
|
|
||
| describe('Test Dependency-Track no vulnerabilities', () => { | ||
| const tmpobj = tmp.dirSync({unsafeCleanup: true}) | ||
|
|
||
| test | ||
| .stdout() | ||
| .command([ | ||
| 'convert dependency_track2hdf', | ||
| '-i', | ||
| path.resolve( | ||
| './test/sample_data/dependency_track/sample_input_report/fpf-no-vulnerabilities.json', | ||
| ), | ||
| '-o', | ||
| `${tmpobj.name}/dependencytracktest.json`, | ||
| ]) | ||
| .it('hdf-converter output test', () => { | ||
| const converted = JSON.parse( | ||
| fs.readFileSync(`${tmpobj.name}/dependencytracktest.json`, 'utf8'), | ||
| ) | ||
| const sample = JSON.parse( | ||
| fs.readFileSync( | ||
| path.resolve('./test/sample_data/dependency_track/hdf-no-vulnerabilities.json'), | ||
| 'utf8', | ||
| ), | ||
| ) | ||
| expect(omitHDFChangingFields(converted)).to.eql( | ||
| omitHDFChangingFields(sample), | ||
| ) | ||
| }) | ||
| }) | ||
|
|
||
| describe('Test Dependency-Track with attributions', () => { | ||
| const tmpobj = tmp.dirSync({unsafeCleanup: true}) | ||
|
|
||
| test | ||
| .stdout() | ||
| .command([ | ||
| 'convert dependency_track2hdf', | ||
| '-i', | ||
| path.resolve( | ||
| './test/sample_data/dependency_track/sample_input_report/fpf-with-attributions.json', | ||
| ), | ||
| '-o', | ||
| `${tmpobj.name}/dependencytracktest.json`, | ||
| ]) | ||
| .it('hdf-converter output test', () => { | ||
| const converted = JSON.parse( | ||
| fs.readFileSync(`${tmpobj.name}/dependencytracktest.json`, 'utf8'), | ||
| ) | ||
| const sample = JSON.parse( | ||
| fs.readFileSync( | ||
| path.resolve('./test/sample_data/dependency_track/hdf-with-attributions.json'), | ||
| 'utf8', | ||
| ), | ||
| ) | ||
| expect(omitHDFChangingFields(converted)).to.eql( | ||
| omitHDFChangingFields(sample), | ||
| ) | ||
| }) | ||
| }) | ||
|
|
||
| describe('Test Dependency-Track info vulnerability', () => { | ||
| const tmpobj = tmp.dirSync({unsafeCleanup: true}) | ||
|
|
||
| test | ||
| .stdout() | ||
| .command([ | ||
| 'convert dependency_track2hdf', | ||
| '-i', | ||
| path.resolve( | ||
| './test/sample_data/dependency_track/sample_input_report/fpf-info-vulnerability.json', | ||
| ), | ||
| '-o', | ||
| `${tmpobj.name}/dependencytracktest.json`, | ||
| ]) | ||
| .it('hdf-converter output test', () => { | ||
| const converted = JSON.parse( | ||
| fs.readFileSync(`${tmpobj.name}/dependencytracktest.json`, 'utf8'), | ||
| ) | ||
| const sample = JSON.parse( | ||
| fs.readFileSync( | ||
| path.resolve('./test/sample_data/dependency_track/hdf-info-vulnerability.json'), | ||
| 'utf8', | ||
| ), | ||
| ) | ||
| expect(omitHDFChangingFields(converted)).to.eql( | ||
| omitHDFChangingFields(sample), | ||
| ) | ||
| }) | ||
| }) |
Oops, something went wrong.