added parser for grype report

jenkinsci · Jul 26, 2023 · 4dc09c0 · 4dc09c0
1 parent 34f81e1
commit 4dc09c0
Show file tree

Hide file tree

Showing 6 changed files with 4,165 additions and 1 deletion.
diff --git a/SUPPORTED-FORMATS.md b/SUPPORTED-FORMATS.md
@@ -1,4 +1,4 @@
-<!--- DO NOT EDIT -- Generated at 2023-05-05T12:05:52.316441 - Run the `main` method of `ParserRegistry` to regenerate after changing parsers -- DO NOT EDIT --->
+<!--- DO NOT EDIT -- Generated at 2023-07-02T18:56:49.380384255 - Run the `main` method of `ParserRegistry` to regenerate after changing parsers -- DO NOT EDIT --->
 # Supported Report Formats
 
 The static analysis model supports the following report formats.
@@ -938,6 +938,22 @@ If your tool is supported, but some properties are missing (icon, URL, etc.), pl
                 -
             </td>
         </tr>
+        <tr>
+            <td>
+                grypescanner
+            </td>
+            <td>
+                <img src="https://user-images.githubusercontent.com/5199289/136855393-d0a9eef9-ccf1-4e2b-9d7c-7aad16a567e5.png" alt="Grype scanner" height="64" width="64">
+            </td>
+            <td>
+                <a href="https://github.com/anchore/grype">
+                    Grype scanner
+                </a>
+            </td>
+            <td>
+                /tmp/1.json
+            </td>
+        </tr>
         <tr>
             <td>
                 hadolint

diff --git a/src/main/java/edu/hm/hafner/analysis/parser/GrypeParser.java b/src/main/java/edu/hm/hafner/analysis/parser/GrypeParser.java
@@ -0,0 +1,66 @@
+package edu.hm.hafner.analysis.parser;
+
+import edu.hm.hafner.analysis.Issue;
+import edu.hm.hafner.analysis.IssueBuilder;
+import edu.hm.hafner.analysis.Report;
+import edu.hm.hafner.analysis.Severity;
+import edu.umd.cs.findbugs.annotations.CheckForNull;
+import org.json.JSONArray;
+import org.json.JSONObject;
+
+import static java.lang.String.*;
+
+/**
+ * JSON report parser for grype (https://plugins.jenkins.io/grypescanner/ / https://github.com/anchore/grype).
+ */
+public class GrypeParser extends JsonIssueParser {
+    private static final long serialVersionUID = -1369431674771459756L;
+
+    private static final String MATCHES_TAG = "matches";
+    private static final String VULNERABILIY_TAG = "vulnerability";
+    private static final String ARTIFACT_TAG = "artifact";
+    private static final String LOCATIONS_TAG = "locations";
+    private static final String PATH_TAG = "path";
+    private static final String DATA_SOURCE_TAG = "dataSource";
+    private static final String SEVERITY_TAG = "severity";
+    private static final String ID_TAG = "id";
+    private static final String DESCRIPTION_TAG = "description";
+
+    @Override
+    protected void parseJsonObject(final Report report, final JSONObject jsonReport, final IssueBuilder issueBuilder) {
+        final JSONArray matches = jsonReport.getJSONArray(MATCHES_TAG);
+        for (int i = 0; i < matches.length(); i++) {
+            final JSONObject match = matches.getJSONObject(i);
+            if (!match.has(VULNERABILIY_TAG)) {
+                continue;
+            }
+            JSONObject vuln = match.getJSONObject(VULNERABILIY_TAG);
+            String fileName = match.getJSONObject(ARTIFACT_TAG).getJSONArray(LOCATIONS_TAG).getJSONObject(0)
+                    .getString(PATH_TAG);
+            Issue issue = issueBuilder.setFileName(fileName)
+                    .setCategory(vuln.getString(SEVERITY_TAG))
+                    .setSeverity(mapSeverity(vuln.getString(SEVERITY_TAG)))
+                    .setType(vuln.getString(ID_TAG))
+                    .setMessage(vuln.getString(DESCRIPTION_TAG))
+                    .setOriginName("Grype")
+                    .setPathName(fileName)
+                    .setDescription(vuln.getString(DATA_SOURCE_TAG)).build();
+            report.add(issue);
+        }
+    }
+
+    private Severity mapSeverity(final String severity) {
+        switch (severity.toUpperCase()) {
+            case "LOW":
+                return Severity.WARNING_LOW;
+            case "MEDIUM":
+                return Severity.WARNING_NORMAL;
+            case "CRITICAL":
+                return Severity.ERROR;
+            case "HIGH":
+                return Severity.WARNING_HIGH;
+            default:
+                return new Severity(severity);
+        }
+    }
+}
diff --git a/src/main/java/edu/hm/hafner/analysis/registry/GrypeDescriptor.java b/src/main/java/edu/hm/hafner/analysis/registry/GrypeDescriptor.java
@@ -0,0 +1,37 @@
+package edu.hm.hafner.analysis.registry;
+
+import edu.hm.hafner.analysis.IssueParser;
+import edu.hm.hafner.analysis.parser.GrypeParser;
+
+/**
+ * Descriptor for Grype report parser.
+ */
+public class GrypeDescriptor extends ParserDescriptor {
+    private static final String ID = "grypescanner";
+    private static final String NAME = "Grype scanner";
+
+    GrypeDescriptor() {
+        super(ID, NAME);
+    }
+
+    @Override
+    public IssueParser createParser(final Option... options) {
+        return new GrypeParser();
+    }
+
+    @Override
+    public String getPattern() {
+	return "**/grype-report.json";
+    }
+
+    @Override
+    public String getUrl() {
+        return "https://github.com/anchore/grype";
+    }
+
+    @Override
+    public String getIconUrl() {
+        return "https://user-images.githubusercontent.com/5199289/136855393-d0a9eef9-ccf1-4e2b-9d7c-7aad16a567e5.png";
+    }
+
+}
diff --git a/src/main/java/edu/hm/hafner/analysis/registry/ParserRegistry.java b/src/main/java/edu/hm/hafner/analysis/registry/ParserRegistry.java
@@ -1,5 +1,7 @@
 package edu.hm.hafner.analysis.registry;
 
+import j2html.tags.ContainerTag;
+import j2html.tags.DomContent;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.nio.charset.StandardCharsets;
@@ -92,6 +94,7 @@ public class ParserRegistry {
             new GnuFortranDescriptor(),
             new GoLintDescriptor(),
             new GoVetDescriptor(),
+            new GrypeDescriptor(),
             new HadoLintDescriptor(),
             new IarCstatDescriptor(),
             new IarDescriptor(),

diff --git a/src/test/java/edu/hm/hafner/analysis/parser/GrypeParserTest.java b/src/test/java/edu/hm/hafner/analysis/parser/GrypeParserTest.java
@@ -0,0 +1,40 @@
+package edu.hm.hafner.analysis.parser;
+
+import edu.hm.hafner.analysis.AbstractParserTest;
+import edu.hm.hafner.analysis.IssueParser;
+import edu.hm.hafner.analysis.Report;
+import edu.hm.hafner.analysis.Severity;
+import edu.hm.hafner.analysis.assertions.SoftAssertions;
+
+class GrypeParserTest extends AbstractParserTest {
+    protected GrypeParserTest() {
+        super("grype-report.json");
+    }
+
+    @Override
+    protected void assertThatIssuesArePresent(final Report report, final SoftAssertions softly) {
+        softly.assertThat(report).hasSize(29).hasDuplicatesSize(0);
+        softly.assertThat(report.get(0))
+                .hasFileName("tomcat-jdbc/8.0.28/tomcat-jdbc-8.0.28.jar")
+                .hasSeverity(Severity.WARNING_NORMAL)
+                .hasCategory("Medium")
+                .hasType("CVE-2015-5345")
+                .hasMessage(
+                        "The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.")
+                .hasDescription("https://nvd.nist.gov/vuln/detail/CVE-2015-5345");
+
+        softly.assertThat(report.get(17))
+                .hasFileName("tomcat-jdbc/8.0.28/tomcat-jdbc-8.0.28.jar")
+                .hasSeverity(Severity.WARNING_HIGH)
+                .hasCategory("High")
+                .hasType("CVE-2016-8745")
+                .hasMessage(
+                        "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.")
+                .hasDescription("https://nvd.nist.gov/vuln/detail/CVE-2016-8745");
+    }
+
+    @Override
+    protected IssueParser createParser() {
+        return new GrypeParser();
+    }
+}