OWASP-Benchmark / BenchmarkUtils

OWASP Benchmark Project Utilities - Provides scorecard generation and crawling tools for Benchmark style test suites.
https://owasp.org/www-project-benchmark/
GNU General Public License v3.0
13 stars 48 forks source link

Fixing veracode reader condition check #37

Closed 0xgoto closed 1 year ago

0xgoto commented 1 year ago

I was trying to check the score for the scan result that I got using Veracode. Benchmark has the support for this, but still, it was not generating a scorecard. The next format of Veracode results has an empty line (Second line). But the Veracode Reader takes the empty line for checking whether it is a Veracode result or not.

In the older format, the data starts from line 2, whereas now the data starts from line 3. So I have added a condition that supports both the old and new formats.

darkspirit510 commented 1 year ago

Thank you for the PR. If possible, can you reduce the test file so it's easier to understand?

And, if you don't mind/are allowed to, can you send me the old and new result file to github@darkspirit510.de, i'd also like to add a test for the old format and compare them.

0xgoto commented 1 year ago

I have reduced the test file and also mailed you the example files for the new and old formats

darkspirit510 commented 1 year ago

Thank you, the files work for me. Can you go through my other comments, too?

Edit: I did not know that I have to "release" my comments 🙈

darkspirit510 commented 1 year ago

Just checked out and testet your changes. It works well, thank you!

One little thing: Can you please run mvn compile and commit your testfile afterwards? The maven task applies some linting to the test file.

Now it's up to @davewichers 😉

0xgoto commented 1 year ago

I ran mvn compile. It ran successfully and there is no changes to commit

darkspirit510 commented 1 year ago

That's weird...

sknoop:BenchmarkUtils/ (pr-veracode) $ gss
sknoop:BenchmarkUtils/ (pr-veracode) $ mvn compile
[...]
[INFO] BUILD SUCCESS
[...]
sknoop:BenchmarkUtils/ (pr-veracode) $ gss
 M plugin/src/test/resources/testfiles/Benchmark_Veracode.xml
0xgoto commented 1 year ago

What to do?

❯ mvn compile
[...]
[INFO] BUILD SUCCESS
[...] 
❯ git status
On branch main
Your branch is up to date with 'origin/main'.

nothing to commit, working tree clean
darkspirit510 commented 1 year ago

I don't know, why it remains unchanged for you. Just ignore it, I can fix it later. The rest is fine, we just have to wait for Dave's approval. 😊