FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Fix some errors in the HTML generated for the scorecards. Add some · ghdevnull/BenchmarkJava@6bf88e9 · GitHub

/ BenchmarkJava Public
forked from OWASP-Benchmark/BenchmarkJava

Commit 6bf88e9

Browse files
davewichers
committed
Fix some errors in the HTML generated for the scorecards. Add some
error handling to the scorecard generator.
1 parent 996a5de commit 6bf88e9

11 files changed

Lines changed: 79 additions & 85 deletions

File tree

‎src/config/web.xml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@
5959
<param-name>hstsIncludeSubDomains</param-name>
6060
<param-value>true</param-value>
6161
</init-param>
62-
<async-supported>true</async-supported>
6362
</filter>
6463
<filter-mapping>
6564
<filter-name>httpHeaderSecurity</filter-name>

‎src/main/java/org/owasp/benchmark/helpers/filters/HTTPResponseHeaderFilter.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
*/
1919

2020
import java.io.IOException;
21-
import java.sql.SQLException;
2221

2322
import javax.servlet.Filter;
2423
import javax.servlet.FilterChain;

‎src/main/java/org/owasp/benchmark/score/BenchmarkScore.java‎

Lines changed: 61 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@
5959
import org.owasp.benchmark.score.parsers.BurpReader;
6060
import org.owasp.benchmark.score.parsers.CASTAIPReader;
6161
import org.owasp.benchmark.score.parsers.CheckmarxESReader;
62-
import org.owasp.benchmark.score.parsers.CheckmarxReader;
6362
import org.owasp.benchmark.score.parsers.CheckmarxIASTReader;
63+
import org.owasp.benchmark.score.parsers.CheckmarxReader;
6464
import org.owasp.benchmark.score.parsers.ContrastReader;
6565
import org.owasp.benchmark.score.parsers.Counter;
6666
import org.owasp.benchmark.score.parsers.CoverityReader;
@@ -715,28 +715,29 @@ else if ( filename.endsWith( ".xml" ) ) {
715715

716716
String line1 = getLine( fileToParse, 0 );
717717
String line2 = getLine( fileToParse, 1 );
718+
String line4;
718719

719-
if ( line2.startsWith( " <ProjectName>" )) {
720+
if ( line2 != null && line2.startsWith( " <ProjectName>" )) {
720721
tr = new ThunderScanReader().parse(fileToParse);
721722
}
722723

723-
else if ( line2.startsWith( "<pmd" )) {
724+
else if ( line2 != null && line2.startsWith( "<pmd" )) {
724725
tr = new PMDReader().parse( fileToParse );
725726
}
726727

727-
else if ( line2.toLowerCase().startsWith( "<castaip" ) ) {
728+
else if ( line2 != null && line2.toLowerCase().startsWith( "<castaip" ) ) {
728729
tr = new CASTAIPReader().parse( fileToParse );
729730
}
730731

731-
else if ( line2.startsWith( "<FusionLiteInsight" )) {
732+
else if ( line2 != null && line2.startsWith( "<FusionLiteInsight" )) {
732733
tr = new FusionLiteInsightReader().parse( fileToParse );
733734
}
734735

735-
else if ( line2.startsWith( "<XanitizerFindingsList" )) {
736+
else if ( line2 != null && line2.startsWith( "<XanitizerFindingsList" )) {
736737
tr = new XanitizerReader().parse( fileToParse );
737738
}
738739

739-
else if ( line2.startsWith( "<BugCollection" )) {
740+
else if ( line2 != null && line2.startsWith( "<BugCollection" )) {
740741
tr = new FindbugsReader().parse( fileToParse );
741742

742743
// change the name of the tool if the filename contains findsecbugs
@@ -749,39 +750,41 @@ else if ( line2.startsWith( "<BugCollection" )) {
749750
}
750751
}
751752

752-
else if ( line2.startsWith( "<ResultsSession" )) {
753+
else if ( line2 != null && line2.startsWith( "<ResultsSession" )) {
753754
tr = new ParasoftReader().parse( fileToParse );
754755
}
755756

756-
else if ( line2.startsWith( "<detailedreport" )) {
757+
else if ( line2 != null && line2.startsWith( "<detailedreport" )) {
757758
tr = new VeracodeReader().parse( fileToParse );
758759
}
759760

760-
else if ( line1.startsWith( "<total" )) {
761+
else if ( line1.startsWith( "<total" ) || line1.startsWith( "<p>" )) {
761762
tr = new SonarQubeReader().parse( fileToParse );
762763
}
763764

764-
else if ( line1.contains( "<OWASPZAPReport" ) || line2.contains( "<OWASPZAPReport" )) {
765+
else if ( line1.contains( "<OWASPZAPReport" ) ||
766+
( line2 != null && line2.contains( "<OWASPZAPReport" )) ) {
765767
tr = new ZapReader().parse( fileToParse );
766768
}
767769

768-
else if ( line2.startsWith( "<CxXMLResults" )) {
770+
else if ( line2 != null && line2.startsWith( "<CxXMLResults" )) {
769771
tr = new CheckmarxReader().parse( fileToParse );
770772
}
771773

772-
else if ( line2.contains( "Arachni" )) {
774+
else if ( line2 != null && line2.contains( "Arachni" )) {
773775
tr = new ArachniReader().parse( fileToParse );
774776
}
775777

776-
else if ( line2.startsWith( "<analysisResult") || line2.startsWith( "<analysisReportResult")) {
778+
else if ( line2 != null && (line2.startsWith( "<analysisResult") ||
779+
line2.startsWith( "<analysisReportResult"))) {
777780
tr = new JuliaReader().parse( fileToParse );
778781
}
779782

780-
else if (line2.startsWith("<CodeIssueCollection")) {
783+
else if ( line2 != null && line2.startsWith("<CodeIssueCollection")) {
781784
tr = new VisualCodeGrepperReader().parse(fileToParse);
782785
}
783786

784-
else if ( getLine( fileToParse, 4 ).contains( "Wapiti" )) {
787+
else if ( (line4 = getLine( fileToParse, 4 )) != null && line4.contains( "Wapiti" )) {
785788
tr = new WapitiReader().parse( fileToParse );
786789
}
787790

@@ -910,50 +913,46 @@ else if ( filename.endsWith( ".sl" ) ) {
910913

911914
else System.out.println("Error: No matching parser found for file: " + filename);
912915

913-
// If the version # of the tool is specified in the results file name, extract it, and set it.
914-
// For example: Benchmark-1.1-Coverity-results-v1.3.2661-6720.json (the version # is 1.3.2661 in this example).
915-
// This code should also handle: Benchmark-1.1-Coverity-results-v1.3.2661.xml (where the compute time '-6720' isn't specified)
916-
int indexOfVersionMarker = filename.lastIndexOf("-v");
917-
if ( indexOfVersionMarker != -1) {
918-
String restOfFileName = filename.substring(indexOfVersionMarker+2);
919-
int endIndex = restOfFileName.lastIndexOf('-');
920-
if (endIndex == -1) endIndex = restOfFileName.lastIndexOf('.');
921-
String version = restOfFileName.substring(0, endIndex);
922-
tr.setToolVersion(version);
916+
// If we have results, see if the version # is in the results file name.
917+
if (tr != null) {
918+
// If version # specified in the results file name, extract it, and set it.
919+
// For example: Benchmark-1.1-Coverity-results-v1.3.2661-6720.json (the version # is 1.3.2661 in this example).
920+
// This code should also handle: Benchmark-1.1-Coverity-results-v1.3.2661.xml (where the compute time '-6720' isn't specified)
921+
int indexOfVersionMarker = filename.lastIndexOf("-v");
922+
if ( indexOfVersionMarker != -1) {
923+
String restOfFileName = filename.substring(indexOfVersionMarker+2);
924+
int endIndex = restOfFileName.lastIndexOf('-');
925+
if (endIndex == -1) endIndex = restOfFileName.lastIndexOf('.');
926+
String version = restOfFileName.substring(0, endIndex);
927+
tr.setToolVersion(version);
928+
}
923929
}
924930

925931
return tr;
926932
}
927933

928934
/**
929-
* Read the 2nd line of the provided file. If its blank, skip all blank lines until a non-blank line
930-
* is found and return that. Return "" if no none blank line is found from the second line on.
931-
* @return The first non-blank line in the file starting with the 2nd line.
935+
* Read the specified line of the provided file. If its blank, skip all blank lines until a non-blank
936+
* line is found and return that. Return "" if no non-blank line is found from the specified line on.
937+
* @return The first non-blank line in the file starting with the specified line. null if there aren't
938+
* that many lines in the file.
932939
*/
933-
private static String getLine(File actual, int line) {
934-
BufferedReader br = null;
935-
try {
936-
br = new BufferedReader( new FileReader( actual ) );
937-
for ( int i=0; i<line; i++ ) {
938-
br.readLine(); // Skip line 1
939-
}
940-
String line2 = "";
941-
while ( line2.equals( "" ) ) {
942-
line2 = br.readLine();
943-
}
944-
return line2;
945-
} catch( Exception e ) {
946-
return "";
947-
} finally {
948-
try {
949-
if (br != null) br.close();
950-
} catch (IOException e) {
951-
System.out.println("Can't close filereader for file: " + actual.getAbsolutePath() +
952-
" for some reason.");
953-
e.toString();
954-
}
955-
}
956-
}
940+
private static String getLine(File actual, int lineNum) {
941+
942+
try (BufferedReader br = new BufferedReader( new FileReader( actual )) ) {
943+
// Skip all the lines before the line # requested
944+
String line = null;
945+
for ( int i=0; i<=lineNum; i++ ) {
946+
line = br.readLine();
947+
}
948+
while ( "".equals( line )) {
949+
line = br.readLine();
950+
}
951+
return line;
952+
} catch( IOException e ) {
953+
return "";
954+
}
955+
}
957956

958957
// Go through each expected result, and figure out if this tool actually passed or not.
959958
// This updates the expected results to reflect what passed/failed.
@@ -1267,6 +1266,7 @@ else if (scatter.getCommercialHigh() >= 50)
12671266
+ new DecimalFormat("0.0").format((float) commercialHighTotal/(float) numberOfVulnCategories) + "</td>");
12681267
htmlForCommercialAverages.append("<td></td>");
12691268
htmlForCommercialAverages.append("</tr>\n");
1269+
htmlForCommercialAverages.append("</table>\n");
12701270

12711271
try {
12721272

@@ -1340,7 +1340,6 @@ else if (r.truePositiveRate > .7 && r.falsePositiveRate < .3)
13401340
}
13411341
}
13421342

1343-
sb.append("</tr>\n");
13441343
sb.append("</table>");
13451344
return sb.toString();
13461345
}
@@ -1384,7 +1383,6 @@ else if (or.getTruePositiveRate() > .7 && or.getFalsePositiveRate() < .3)
13841383
}
13851384
}
13861385

1387-
sb.append("</tr>\n");
13881386
sb.append("</table>");
13891387
sb.append("<p>*-Please refer to each tool's scorecard for the data used to calculate these values.");
13901388

@@ -1401,14 +1399,14 @@ private static void updateMenus(Set<Report> toolResults, Set<String> catSet ) {
14011399
// Create tool menu
14021400
StringBuffer sb = new StringBuffer();
14031401
for ( Report toolReport : toolResults ) {
1404-
if (!(showAveOnlyMode && toolReport.isCommercial())) {
1405-
sb.append("<li><a href=\"");
1406-
sb.append(toolReport.getFilename());
1407-
sb.append(".html\">");
1408-
sb.append(toolReport.getToolNameAndVersion());
1409-
sb.append("</a></li>");
1410-
sb.append(System.lineSeparator());
1411-
}
1402+
if (!(showAveOnlyMode && toolReport.isCommercial())) {
1403+
sb.append("<li><a href=\"");
1404+
sb.append(toolReport.getFilename());
1405+
sb.append(".html\">");
1406+
sb.append(toolReport.getToolNameAndVersion());
1407+
sb.append("</a></li>");
1408+
sb.append(System.lineSeparator());
1409+
}
14121410
}
14131411

14141412
// Before finishing, check to see if there is a commercial average scorecard file, and if so

‎src/main/java/org/owasp/benchmark/score/report/Report.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*
44
* This file is part of the Open Web Application Security Project (OWASP)
55
* Benchmark Project For details, please see
6-
* <a href="https://www.owasp.org/index.php/Benchmark">https://www.owasp.org/index.php/Benchmark</a>.
6+
* <a href="https://owasp.org/www-project-benchmark/">https://owasp.org/www-project-benchmark/</a>.
77
*
88
* The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms
99
* of the GNU General Public License as published by the Free Software Foundation, version 2.
@@ -12,7 +12,7 @@
1212
* even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1313
* GNU General Public License for more details
1414
*
15-
* @author Dave Wichers <a href="https://www.aspectsecurity.com">Aspect Security</a>
15+
* @author Dave Wichers
1616
* @created 2015
1717
*/
1818

@@ -210,7 +210,7 @@ else if (r.truePositiveRate > .7 && r.falsePositiveRate < .3)
210210
if (!Double.isNaN(r.score))
211211
totalScore += r.score;
212212
}
213-
sb.append("<th>Totals*</th><th/>");
213+
sb.append("<tr><th>Totals*</th><th/>");
214214
sb.append("<th>" + totals.tp + "</th>");
215215
sb.append("<th>" + totals.fn + "</th>");
216216
sb.append("<th>" + totals.tn + "</th>");
@@ -219,7 +219,7 @@ else if (r.truePositiveRate > .7 && r.falsePositiveRate < .3)
219219
sb.append("<th>" + total + "</th>");
220220
sb.append("<th/><th/><th/></tr>\n");
221221

222-
sb.append("<th>Overall Results*</th><th/><th/><th/><th/><th/><th/>");
222+
sb.append("<tr><th>Overall Results*</th><th/><th/><th/><th/><th/><th/>");
223223
double tpr = (totalTPR / scores.size());
224224
sb.append("<th>" + new DecimalFormat("#0.00%").format(tpr) + "</th>");
225225
double fpr = (totalFPR / scores.size());

‎src/main/java/org/owasp/benchmark/score/report/ScatterHome.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131
import java.util.Set;
3232

3333
import org.jfree.chart.ChartFactory;
34-
import org.jfree.chart.ChartPanel;
3534
import org.jfree.chart.JFreeChart;
3635
import org.jfree.chart.annotations.XYLineAnnotation;
3736
import org.jfree.chart.annotations.XYTextAnnotation;

‎src/main/java/org/owasp/benchmark/score/report/ScatterInterpretation.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
import java.io.IOException;
2323

2424
import org.jfree.chart.ChartFactory;
25-
import org.jfree.chart.ChartPanel;
2625
import org.jfree.chart.JFreeChart;
2726
import org.jfree.chart.plot.PlotOrientation;
2827
import org.jfree.chart.plot.XYPlot;

‎src/main/java/org/owasp/benchmark/score/report/ScatterTools.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
import java.util.Map.Entry;
2929

3030
import org.jfree.chart.ChartFactory;
31-
import org.jfree.chart.ChartPanel;
3231
import org.jfree.chart.JFreeChart;
3332
import org.jfree.chart.annotations.XYTextAnnotation;
3433
import org.jfree.chart.plot.PlotOrientation;

‎src/main/java/org/owasp/benchmark/score/report/ScatterVulns.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131
import java.util.Set;
3232

3333
import org.jfree.chart.ChartFactory;
34-
import org.jfree.chart.ChartPanel;
3534
import org.jfree.chart.JFreeChart;
3635
import org.jfree.chart.annotations.XYLineAnnotation;
3736
import org.jfree.chart.annotations.XYTextAnnotation;

‎src/main/resources/scorecard/commercialAveTemplate.html‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,14 +72,14 @@ <h3>OWASP Benchmark Scorecard for Commercial Tools</h3>
7272

7373
<p>For more information, please visit the <a href="https://www.owasp.org/index.php/Benchmark">OWASP Benchmark Project Site</a>.
7474

75-
<p>
76-
<p>
75+
<p/>
76+
<p/>
7777

7878
<h2>Average Scores Per Vulnerability for Commercial Tools</h2>
7979
${table}
8080

81-
<p>
82-
<p>
81+
<p/>
82+
<p/>
8383

8484
<h2>Key</h2>
8585
<table class="table">

‎src/main/resources/scorecard/template.html‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -83,20 +83,22 @@ <h2>Statistics</h2>
8383
<th>Tool overall score (0-100)</th>
8484
<td>${score}</td>
8585
</tr>
86+
<tr>
8687
<th>Total test cases</th>
8788
<td>${tests}</td>
89+
</tr>
8890
<tr>
8991
<th>Download raw results</th>
90-
<td><a href="${actualResultsFile}" download>Actual Results</a></td>
92+
<td><a href="${actualResultsFile}" >Actual Results</a></td>
9193
</tr>
9294
</table>
9395

94-
<p>
95-
<p>
96+
<p/>
97+
<p/>
9698

9799
<h2>Detailed Results</h2>
98100
${table}
99-
<p>
101+
<p/>
100102

101103

102104
<h2>Key</h2>

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL