diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 6473043139..0f7fecd68c 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -34,7 +34,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@v4.39.2 with: languages: ${{ matrix.language }} queries: security-extended, security-experimental, security-and-quality @@ -43,7 +43,7 @@ jobs: run: mvn -DskipTests=true install - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@v4.39.2 - name: Upload Output uses: actions/upload-artifact@v7 diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml index 5b79bcade4..da4cec6453 100644 --- a/.github/workflows/maven.yaml +++ b/.github/workflows/maven.yaml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Set up JDK 17 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: 17 distribution: zulu diff --git a/pom.xml b/pom.xml index fdd6e15b5c..70d03065d6 100644 --- a/pom.xml +++ b/pom.xml @@ -636,7 +636,7 @@ commons-codec commons-codec - 1.22.0 + 1.23.0 @@ -663,9 +663,10 @@ org.slf4j slf4j-reload4j - 2.0.18 + 2.0.20 + org.apache.directory.api api-ldap-model @@ -777,13 +778,13 @@ org.apache.httpcomponents.client5 httpclient5 - 5.6.2 + 5.6.5 org.apache.httpcomponents.core5 httpcore5 - 5.4.3 + 5.4.4 @@ -866,7 +867,20 @@ com.fasterxml.jackson.core jackson-databind - 2.22.0 + 2.22.4 + + + + org.junit.jupiter + junit-jupiter-api + ${version.junit} + test + + + org.junit.jupiter + junit-jupiter-params + ${version.junit} + test @@ -936,7 +950,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 true 1000m @@ -948,18 +962,18 @@ org.apache.maven.plugins maven-deploy-plugin - 3.1.4 + 3.2.0 org.apache.maven.plugins maven-enforcer-plugin - 3.6.3 + 3.7.0 org.codehaus.mojo extra-enforcer-rules - 1.12.0 + 1.12.1 @@ -1005,7 +1019,7 @@ org.apache.maven.plugins maven-install-plugin - 3.1.4 + 3.2.0 @@ -1050,7 +1064,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.6 + 3.6.1 @@ -1065,13 +1079,13 @@ org.codehaus.cargo cargo-maven3-plugin - 1.10.27 + 1.10.30 org.codehaus.mojo versions-maven-plugin - 2.21.0 + 2.23.0 @@ -1116,7 +1130,7 @@ com.diffplug.spotless spotless-maven-plugin - 3.8.0 + 3.11.0 origin/master @@ -1255,19 +1269,20 @@ ${project.build.directory}/log - 2.1.8 + 2.1.9 2.0.0.AM27 2.1.0 3.6.10.Final - 4.10.2.0 - 4.10.2 + 5.14.4 + 4.10.5.0 + 4.10.5 5.3.39 9 - 9.0.115 - https://archive.apache.org/dist/tomcat/tomcat-${tomcat.major.version}/v${version.tomcat}/bin/apache-tomcat-${version.tomcat}.zip + 9.0.122 + https://downloads.apache.org/tomcat/tomcat-${tomcat.major.version}/v${version.tomcat}/bin/apache-tomcat-${version.tomcat}.zip diff --git a/scripts/runSonarQube.sh b/scripts/runSonarQube.sh index a2972589ea..97a7ad893f 100755 --- a/scripts/runSonarQube.sh +++ b/scripts/runSonarQube.sh @@ -13,11 +13,6 @@ requireCommand curl requireCommand docker requireCommand jq -if ! command -v "sonar-report" &> /dev/null; then - echo "sonar-report is required. Please install it via https://github.com/soprasteria/sonar-report and then try again." - exit 1 -fi - # Check for install/updates at https://github.com/SonarSource/sonarqube container_name="sonarqube-benchmark" @@ -69,11 +64,12 @@ echo "Starting scan... (might take some time!)" container_ip=$(docker inspect "$container_name" | jq -r '.[0].NetworkSettings.Networks.bridge.IPAddress' ) sonar_docker_host="http://$container_ip:$sonar_internal_port" -docker run --env SONAR_SCANNER_OPTS=-Xmx4g --rm -v ~/.m2:/root/.m2 -v "$(pwd)":"$(pwd)" -w "$(pwd)" sonarsource/sonar-scanner-cli \ +docker run --env SONAR_SCANNER_OPTS=-Xmx4g --rm -v ~/.m2:/root/.m2 -v "$(pwd)":/benchmark -w "/benchmark" sonarsource/sonar-scanner-cli \ + -Dsonar.projectBaseDir="/benchmark" \ -Dsonar.java.binaries="target" \ -Dsonar.projectKey="$sonar_project" \ -Dsonar.host.url="$sonar_docker_host" \ - -Dsonar.login="$sonar_token" \ + -Dsonar.token="$sonar_token" \ -Dsonar.sources="src" \ -Dsonar.exclusions="results/**,scorecard/**,scripts/**,tools/**,VMs/**,**/*.js" @@ -87,8 +83,9 @@ done echo "" echo "Generating report..." +mvn compile mvn exec:java -Dexec.mainClass="org.owasp.benchmark.report.sonarqube.SonarReport" echo "Shutting down SonarQube..." -#docker stop "$container_name" +docker stop "$container_name" diff --git a/src/main/java/org/owasp/benchmark/report/sonarqube/SonarReport.java b/src/main/java/org/owasp/benchmark/report/sonarqube/SonarReport.java index c9fb1459f9..8eb6f438de 100644 --- a/src/main/java/org/owasp/benchmark/report/sonarqube/SonarReport.java +++ b/src/main/java/org/owasp/benchmark/report/sonarqube/SonarReport.java @@ -35,16 +35,19 @@ public class SonarReport { private static final ObjectMapper objectMapper = new ObjectMapper(); public static void main(String[] args) throws Exception { - String allJavaRules = String.join(",", allJavaRules()); + Set allJavaRules = allJavaRules(); List issues = new ArrayList<>(); List hotspots = new ArrayList<>(); - forAllPagesAt( - "issues/search?componentKeys=" - + SONAR_PROJECT - + "&types=VULNERABILITY&&rules=" - + allJavaRules, - (result -> issues.addAll(result.issues))); + for (String rule : allJavaRules) { + forAllPagesAt( + "issues/search?componentKeys=" + + SONAR_PROJECT + + "&types=VULNERABILITY&rules=" + + rule, + (result -> issues.addAll(result.issues))); + } + forAllPagesAt( "hotspots/search?projectKey=" + SONAR_PROJECT, (result -> hotspots.addAll(result.hotspots))); @@ -91,7 +94,9 @@ private static void forAllPagesAt(String apiPath, Consumer page objectMapper.readValue( apiCall(apiPath + pagingSuffix(page, apiPath)), SonarQubeResult.class); - pages = (result.paging.resultCount / PAGE_SIZE) + 1; + pages = + (result.paging.resultCount / PAGE_SIZE) + + (result.paging.resultCount % PAGE_SIZE == 0 ? 0 : 1); pageHandlerCallback.accept(result); @@ -110,6 +115,11 @@ private static String apiCall(String apiPath) throws IOException { connection.setDoOutput(true); connection.setRequestProperty("Authorization", "Basic " + sonarAuth); + int status = connection.getResponseCode(); + if (status != 200) { + throw new IOException("SonarQube API returned HTTP " + status + " for " + apiPath); + } + return join("\n", readLines(connection.getInputStream(), defaultCharset())); } diff --git a/src/test/java/org/owasp/benchmark/report/sonarqube/SonarReportTest.java b/src/test/java/org/owasp/benchmark/report/sonarqube/SonarReportTest.java new file mode 100644 index 0000000000..6ba26343c2 --- /dev/null +++ b/src/test/java/org/owasp/benchmark/report/sonarqube/SonarReportTest.java @@ -0,0 +1,95 @@ +/** + * OWASP Benchmark Project + * + *

This file is part of the Open Web Application Security Project (OWASP) Benchmark Project For + * details, please see https://owasp.org/www-project-benchmark/. + * + *

The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms + * of the GNU General Public License as published by the Free Software Foundation, version 2. + * + *

The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + * PURPOSE. See the GNU General Public License for more details. + */ +package org.owasp.benchmark.report.sonarqube; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertFalse; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.CsvSource; + +public class SonarReportTest { + + private static final int PAGE_SIZE = 500; + + /** + * Replicates the fixed paging formula from SonarReport.forAllPagesAt(). The old formula was + * {@code (resultCount / PAGE_SIZE) + 1}, which over-counts by 1 when resultCount is an exact + * multiple of PAGE_SIZE. + */ + private static int calculatePages(int resultCount) { + return (resultCount / PAGE_SIZE) + (resultCount % PAGE_SIZE == 0 ? 0 : 1); + } + + @ParameterizedTest(name = "resultCount={0} => pages={1}") + @CsvSource({ + "0, 0", + "1, 1", + "499, 1", + "500, 1", + "501, 2", + "999, 2", + "1000, 2", + "1001, 3", + "10000, 20", + "10001, 21" + }) + void pageCalculationProducesCorrectCeiling(int resultCount, int expectedPages) { + assertEquals( + expectedPages, + calculatePages(resultCount), + "Paging for " + resultCount + " results at page size " + PAGE_SIZE); + } + + @Test + void oldFormulaOvercountsOnExactMultiple() { + int resultCount = 1000; + int oldFormula = (resultCount / PAGE_SIZE) + 1; + int fixedFormula = calculatePages(resultCount); + + assertEquals(3, oldFormula, "Old formula produces 3 pages for 1000 results (wrong)"); + assertEquals(2, fixedFormula, "Fixed formula produces 2 pages for 1000 results (correct)"); + } + + @Test + void issueSearchUrlHasNoDoubleAmpersand() { + String sonarProject = "benchmark"; + String rule = "java:S1234"; + + String fixedUrl = + "issues/search?componentKeys=" + + sonarProject + + "&types=VULNERABILITY&rules=" + + rule; + + assertFalse(fixedUrl.contains("&&"), "URL must not contain double ampersand"); + } + + @Test + void oldIssueSearchUrlHadDoubleAmpersand() { + String sonarProject = "benchmark"; + String allJavaRules = "java:S1234,java:S5678"; + + String oldUrl = + "issues/search?componentKeys=" + + sonarProject + + "&types=VULNERABILITY&&rules=" + + allJavaRules; + + assertEquals( + true, oldUrl.contains("&&"), "Old URL construction had double ampersand (the bug)"); + } +}