model

Documentation

Index

• type AsffRecommendation
• type AwsAccountInfo
• type AwsSecurityFinding
  • func BuildASFF(summary *model.Summary) []AwsSecurityFinding
• type CSVReport
  • func BuildCSVReport(summary *model.Summary) []CSVReport
• type CodeClimateReport
  • func BuildCodeClimateReport(summary *model.Summary) []CodeClimateReport
• type Compliance
• type Component
• type Components
• type CycloneDxReport
  • func BuildCycloneDxReport(summary *model.Summary, filePaths map[string]string) *CycloneDxReport
  • func InitCycloneDxReport() *CycloneDxReport
• type GitlabSASTReport
  • func NewGitlabSASTReport(start, end time.Time) GitlabSASTReport
• type Hash
• type Issue
• type JUnitReport
  • func NewJUnitReport(time string) JUnitReport
• type Location
• type Metadata
• type Range
• type Rating
• type Recommendation
• type Remediation
• type Resource
• type SarifReport
  • func NewSarifReport() SarifReport
• type SarifRun
• type Severity
• type SonarQubeReport
• type SonarQubeReportBuilder
  • func NewSonarQubeRepory() *SonarQubeReportBuilder
  • func (s *SonarQubeReportBuilder) BuildReport(summary *model.Summary) *SonarQubeReport
• type Source
• type Tool
• type Vulnerability

Types

type AsffRecommendation

type AsffRecommendation struct {
	Text string
}

AsffRecommendation includes the recommendation to avoid the finding

type AwsAccountInfo

type AwsAccountInfo struct {
	AwsAccountID string
	AwsRegion    string
}

AwsAccountInfo contains all the relevant information of the user AWS account

type AwsSecurityFinding

type AwsSecurityFinding struct {
	AwsAccountID  string `json:"AwsAccountId"`
	Compliance    Compliance
	CreatedAt     string
	Description   string
	GeneratorID   string `json:"GeneratorId"`
	ID            string `json:"Id"`
	ProductArn    string
	Remediation   Remediation
	Resources     []Resource
	SchemaVersion string
	Severity      Severity
	Title         string
	Types         []string
	UpdatedAt     string
	CWE           string
}

AwsSecurityFinding contains all the relevant information to build a finding

func BuildASFF

func BuildASFF(summary *model.Summary) []AwsSecurityFinding

BuildASFF builds the ASFF report

type CSVReport

type CSVReport struct {
	QueryName                   string `csv:"query_name"`
	QueryID                     string `csv:"query_id"`
	QueryURI                    string `csv:"query_uri"`
	Severity                    string `csv:"severity"`
	Platform                    string `csv:"platform"`
	CWE                         string `csv:"cwe,omitempty"`
	CloudProvider               string `csv:"cloud_provider"`
	Category                    string `csv:"category"`
	DescriptionID               string `csv:"description_id"`
	Description                 string `csv:"description"`
	CISDescriptionIDFormatted   string `csv:"cis_description_id"`
	CISDescriptionTitle         string `csv:"cis_description_title"`
	CISDescriptionTextFormatted string `csv:"cis_description_text"`
	FileName                    string `csv:"file_name"`
	SimilarityID                string `csv:"similarity_id"`
	Line                        int    `csv:"line"`
	IssueType                   string `csv:"issue_type"`
	SearchKey                   string `csv:"search_key"`
	SearchLine                  int    `csv:"search_line"`
	SearchValue                 string `csv:"search_value"`
	ExpectedValue               string `csv:"expected_value"`
	ActualValue                 string `csv:"actual_value"`
}

CSVReport struct contains all the info to create the csv report

func BuildCSVReport

func BuildCSVReport(summary *model.Summary) []CSVReport

BuildCSVReport builds the CSV report

type CodeClimateReport

type CodeClimateReport struct {
	Type        string   `json:"type"`
	CheckName   string   `json:"check_name"`
	CWE         string   `json:"cwe,omitempty"`
	Description string   `json:"description"`
	Categories  []string `json:"categories"`
	Location    location `json:"location"`
	Severity    string   `json:"severity"`
	Fingerprint string   `json:"fingerprint"`
}

CodeClimateReport struct contains all the info to create the code climate report

func BuildCodeClimateReport

func BuildCodeClimateReport(summary *model.Summary) []CodeClimateReport

BuildCodeClimateReport builds the code climate report

type Compliance

type Compliance struct {
	Status string
}

Compliance contains the status of the finding

type Component

type Component struct {
	// component tag information
	Type   string `xml:"type,attr"`
	BomRef string `xml:"bom-ref,attr"`

	// component body information
	Name            string          `xml:"name"`
	Version         string          `xml:"version"`
	Hashes          []Hash          `xml:"hashes>hash"`
	Purl            string          `xml:"purl"`
	Vulnerabilities []Vulnerability `xml:"v:vulnerabilities>v:vulnerability"`
}

Component includes the CycloneDX component structure properties considered relevant

type Components

type Components struct {
	Components []Component `xml:"component"`
}

Components is a list of components

type CycloneDxReport

type CycloneDxReport struct {
	XMLName xml.Name `xml:"bom"`

	// bom tag information
	XMLNS        string `xml:"xmlns,attr"`
	SerialNumber string `xml:"serialNumber,attr"`
	XMLNSV       string `xml:"xmlns:v,attr"`
	Version      int    `xml:"version,attr"`

	// bom body information
	Metadata   *Metadata  `xml:"metadata"`
	Components Components `xml:"components"`
}

CycloneDxReport includes all the properties considered relevant for the CycloneDX Report

func BuildCycloneDxReport

func BuildCycloneDxReport(summary *model.Summary, filePaths map[string]string) *CycloneDxReport

BuildCycloneDxReport builds the CycloneDX report

func InitCycloneDxReport

func InitCycloneDxReport() *CycloneDxReport

InitCycloneDxReport inits the CycloneDx report with no components (consequently, no vulnerabilities)

type GitlabSASTReport

type GitlabSASTReport interface {
	BuildGitlabSASTVulnerability(issue *model.QueryResult, file *model.VulnerableFile)
}

GitlabSASTReport represents a usable gitlab sast report reference

func NewGitlabSASTReport

func NewGitlabSASTReport(start, end time.Time) GitlabSASTReport

NewGitlabSASTReport initializes a new instance of GitlabSASTReport to be used

type Hash

type Hash struct {
	Alg     string `xml:"alg,attr"`
	Content string `xml:",chardata"`
}

Hash includes the algorithm used in the HASH function and the output of it (content)

type Issue

type Issue struct {
	EngineID           string      `json:"engineId"`
	RuleID             string      `json:"ruleId"`
	Severity           string      `json:"severity"`
	CWE                string      `json:"cwe,omitempty"`
	Type               string      `json:"type"`
	PrimaryLocation    *Location   `json:"primaryLocation"`
	SecondaryLocations []*Location `json:"secondaryLocations,omitempty"`
}

Issue is a single issue for SonarQube Report

type JUnitReport

type JUnitReport interface {
	GenerateTestEntry(query *model.QueryResult)
	FinishReport()
}

JUnitReport is a JUnit report representation

func NewJUnitReport

func NewJUnitReport(time string) JUnitReport

NewJUnitReport creates a new JUnit report instance

type Location

type Location struct {
	Message   string `json:"message"`
	FilePath  string `json:"filePath"`
	TextRange *Range `json:"textRange"`
}

Location is the location for the vulnerability in the SonarQube Report

type Metadata

type Metadata struct {
	Timestamp string  `xml:"timestamp"`  // the timestamp when the CycloneDX report is created
	Tools     *[]Tool `xml:"tools>tool"` // array of tools used to create the CycloneDX report
}

Metadata includes the relevant additional information about the CycloneDX report

type Range

type Range struct {
	StartLine int `json:"startLine"`
}

Range is the range for the vulnerability in the SonarQube Report

type Rating

type Rating struct {
	Severity string `xml:"v:severity"`
	Method   string `xml:"v:method"`
}

Rating includes the severity of the vulnerability and the method used to classify it

type Recommendation

type Recommendation struct {
	Recommendation string `xml:""`
}

Recommendation describes how the vulnerability should be avoided

type Remediation

type Remediation struct {
	Recommendation AsffRecommendation
}

Remediation contains the recommendation

type Resource

type Resource struct {
	ID   string `json:"Id"`
	Type string
}

Resource contains the ID and the type of the target resource

type SarifReport

type SarifReport interface {
	BuildSarifIssue(issue *model.QueryResult) string
	RebuildTaxonomies(cwes []string, guids map[string]string)
	GetGUIDFromRelationships(idx int, cweID string) string
}

SarifReport represents a usable sarif report reference

func NewSarifReport

func NewSarifReport() SarifReport

NewSarifReport creates and start a new sarif report with default values respecting SARIF schema 2.1.0

type SarifRun

type SarifRun struct {
	Tool       sarifTool       `json:"tool"`
	Results    []sarifResult   `json:"results"`
	Taxonomies []sarifTaxonomy `json:"taxonomies"`
}

SarifRun - sarifRun is a component of the SARIF report

type Severity

type Severity struct {
	Original string
	Label    string
}

Severity contains the original severity (KICS severity) and the label severity (ASFF severity)

type SonarQubeReport

type SonarQubeReport struct {
	Issues []Issue `json:"issues"`
}

SonarQubeReport is a list of issues for SonarQube Report

type SonarQubeReportBuilder

type SonarQubeReportBuilder struct {
	// contains filtered or unexported fields
}

SonarQubeReportBuilder is the builder for the SonarQubeReport struct

func NewSonarQubeRepory

func NewSonarQubeRepory() *SonarQubeReportBuilder

NewSonarQubeRepory creates a new SonarQubeReportBuilder instance

func (*SonarQubeReportBuilder) BuildReport

func (s *SonarQubeReportBuilder) BuildReport(summary *model.Summary) *SonarQubeReport

BuildReport builds the SonarQubeReport from the given QueryResults

type Source

type Source struct {
	Name string `xml:"name"`
	URL  string `xml:"url"`
}

Source includes information about the origin where the vulnerability was reported

type Tool

type Tool struct {
	Vendor  string `xml:"vendor"`
	Name    string `xml:"name"`
	Version string `xml:"version"`
}

Tool includes the information about the tool used to create the CycloneDX report

type Vulnerability

type Vulnerability struct {
	// vulnerability tag information
	Ref string `xml:"ref,attr"`

	// vulnerability body information
	ID              string           `xml:"v:id"`
	CWE             string           `xml:"v:cwe"`
	Source          Source           `xml:"v:source"`
	Ratings         []Rating         `xml:"v:ratings>v:rating"`
	Description     string           `xml:"v:description"`
	Recommendations []Recommendation `xml:"v:recommendations>v:recommendation"`
}

Vulnerability includes all the relevant information about the vulnerability