diff --git a/.gitignore b/.gitignore index 9460b39..058ab72 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ node_modules/ sonar-report.html -coverage.lcov \ No newline at end of file +coverage.lcov diff --git a/README.md b/README.md index 57142a1..c3ebfd0 100644 --- a/README.md +++ b/README.md @@ -66,16 +66,13 @@ xdg-open samples/sonar-report_sonar-report.html Summary of the Detected Vulnerabilities - Severity: BLOCKER + Severity: HIGH Number of Issues: 0 - Severity: CRITICAL + Severity: MEDIUM Number of Issues: 0 - Severity: MAJOR - Number of Issues: 0 - - Severity: MINOR + Severity: LOW Number of Issues: 0 ``` diff --git a/index.ejs b/index.ejs index fd646bc..0c6016a 100644 --- a/index.ejs +++ b/index.ejs @@ -34,7 +34,9 @@
Project Name/URL
- <%= projectName %> + + <%= projectName %> +
Application
@@ -77,7 +79,8 @@ <%if (qualityGateStatus) { %> -

Quality Gate Status: <%= qualityGateStatus.projectStatus.status %> since <%= qualityGateStatusPeriodDate %>

+

Quality Gate Status: <%= qualityGateStatus.projectStatus.status %> since <%= qualityGateStatusPeriodDate %> +

@@ -119,31 +122,24 @@ - - - - - - - + + - - + + - - + + @@ -178,7 +174,11 @@ <%= issues[i].rule %> - - - - - - - + + - - + + - - + + @@ -42300,7 +42290,7 @@

See

-Value: <%= condition.actualValue %> <%= condition.comparator == 'GT' ? '>' : '<' %> <%= condition.errorThreshold %> +< <%_ for (const condition of qualityGateStatus.projectStatus.conditions) { _%> Metric: <%= condition.metricKey %> + Value: <%= condition.actualValue %> <%= condition.comparator == 'GT' ? '>' : '<' %> <%= condition.errorThreshold %> + <%_ } _%> <%_ } _%> -<%_ } _%> - -Summary of the Detected <%= vulnerabilityPluralPhrase %> -Severity: BLOCKER -Number of Issues: <%= summary.blocker %> + Summary of the Detected <%= vulnerabilityPluralPhrase %> -Severity: CRITICAL -Number of Issues: <%= summary.critical %> + Severity: HIGH + Number of Issues: <%= summary.high %> -Severity: MAJOR -Number of Issues: <%= summary.major %> + Severity: MEDIUM + Number of Issues: <%= summary.medium %> -Severity: MINOR -Number of Issues: <%= summary.minor %> \ No newline at end of file + Severity: LOW + Number of Issues: <%= summary.low %> \ No newline at end of file
BLOCKER - <%= summary.blocker %> -
CRITICALHIGH - <%= summary.critical %> + <%= summary.high %>
MAJORMEDIUM - <%= summary.major %> + <%= summary.medium %>
MINORLOW - <%= summary.minor %> + <%= summary.low %>
+ <% if(issues[i].severity == "BLOCKER"){ %> + HIGH + <% } else{ %> <%= issues[i].severity %> + <% } %> <%= issues[i].component %> @@ -238,15 +238,14 @@ var ctx = canvas.getContext("2d"); var data = [ - <%= summary.blocker %>, - <%= summary.critical %>, - <%= summary.major %>, - <%= summary.minor %> + <%= summary.high %>, + <%= summary.medium %>, + <%= summary.low %> ]; var total = data.reduce(function(sum, n) { return sum + n; }) - var colors = ['#2c3e50', '#d43223', '#f39c12', '#319ddb']; + var colors = ['#d43223', '#f39c12', '#319ddb']; for (var i = 0, lastend = 0; i < data.length; i++) { ctx.fillStyle = colors[i]; diff --git a/index.js b/index.js index 45b1581..d07b3ca 100644 --- a/index.js +++ b/index.js @@ -163,22 +163,20 @@ const generateReport = async (options) => { const issueLink = options.linkIssues ? (data, issue) => (c) => - `${c}` + `${c}` : (data, issue) => (c) => c; const hotspotLink = options.linkIssues ? (data, hotspot) => (c) => - `${c}` + `${c}` : () => (c) => c; let severity = new Map(); @@ -186,12 +184,12 @@ const generateReport = async (options) => { severity.set("MAJOR", 1); severity.set("CRITICAL", 2); severity.set("BLOCKER", 3); - let hotspotSeverities = { HIGH: "CRITICAL", MEDIUM: "MAJOR", LOW: "MINOR" }; + let hotspotSeverities = { HIGH: "HIGH", MEDIUM: "MEDIUM", LOW: "LOW" }; let properties = []; try { properties = getProperties(readFileSync(options.sonarPropertiesFile)); - } catch (e) {} + } catch (e) { } const data = { date: new Date().toLocaleDateString("en-us", { @@ -513,6 +511,7 @@ const generateReport = async (options) => { }; }) ); + } catch (error) { logError("getting issues", error); return null; @@ -558,13 +557,15 @@ const generateReport = async (options) => { ); const hotspot = JSON.parse(response.body); hSeverity = hotspotSeverities[hotspot.rule.vulnerabilityProbability]; + if (hSeverity === undefined) { - hSeverity = "MAJOR"; + hSeverity = "MEDIUM"; console.error( "Unknown hotspot severity: %s", hotspot.vulnerabilityProbability ); } + data.issues.push({ rule: hotspot.rule.key, severity: hSeverity, @@ -589,12 +590,10 @@ const generateReport = async (options) => { }); data.summary = { - blocker: data.issues.filter((issue) => issue.severity === "BLOCKER") - .length, - critical: data.issues.filter((issue) => issue.severity === "CRITICAL") + high: data.issues.filter((issue) => (issue.severity === "HIGH" || issue.severity === "BLOCKER")) .length, - major: data.issues.filter((issue) => issue.severity === "MAJOR").length, - minor: data.issues.filter((issue) => issue.severity === "MINOR").length, + medium: data.issues.filter((issue) => issue.severity === "MEDIUM").length, + low: data.issues.filter((issue) => issue.severity === "LOW").length, }; } @@ -615,9 +614,9 @@ const generateReport = async (options) => { // https://stackoverflow.com/questions/29085197/how-do-you-json-stringify-an-es6-map if (key === "rules") { return Array.from(value).reduce((obj, [key, value]) => { - obj[key] = value; - return obj; - }, {}); + obj[key] = value; + return obj; + }, {}); } else { return value } diff --git a/samples/sonar-report_sonar-report.html b/samples/sonar-report_sonar-report.html index 45f9544..fed5ad3 100644 --- a/samples/sonar-report_sonar-report.html +++ b/samples/sonar-report_sonar-report.html @@ -84,7 +84,7 @@ max-width: 100% } -li + li { +li+li { margin-top: 3px } @@ -116,7 +116,7 @@ width: 100% } -table + table { +table+table { margin-top: 1em } @@ -155,19 +155,15 @@ background-color: #d4333f } -.sevBLOCKER { - background-color: #2c3e50 -} - -.sevCRITICAL { +.sevHIGH { background-color: #d43223 } -.sevMAJOR { +.sevMEDIUM { background-color: #f39c12 } -.sevMINOR { +.sevLOW { background-color: #319ddb } @@ -176,10 +172,9 @@ } .rulestable { - table-layout: fixed; word-wrap: break-word + table-layout: fixed; + word-wrap: break-word } - - @@ -204,7 +199,9 @@

SonarQube Vulnerability Report

Project Name/URL
- Sonar Report + + Sonar Report +
Application
@@ -246,29 +243,22 @@

Summary of the Detected Vulnerabilities

BLOCKER - 0 -
CRITICALHIGH 0
MAJORMEDIUM 0
MINORLOW 0
-

This rule is deprecated; use S5547 instead.

+

This rule is deprecated; use S5547 instead.

Why is this an issue?

According to the US National Institute of Standards and Technology (NIST), the Data Encryption Standard (DES) is no longer considered secure:

diff --git a/style.css b/style.css index 83d32ce..6ed3f66 100644 --- a/style.css +++ b/style.css @@ -73,7 +73,7 @@ img { max-width: 100% } -li + li { +li+li { margin-top: 3px } @@ -105,7 +105,7 @@ table { width: 100% } -table + table { +table+table { margin-top: 1em } @@ -144,19 +144,15 @@ canvas { background-color: #d4333f } -.sevBLOCKER { - background-color: #2c3e50 -} - -.sevCRITICAL { +.sevHIGH { background-color: #d43223 } -.sevMAJOR { +.sevMEDIUM { background-color: #f39c12 } -.sevMINOR { +.sevLOW { background-color: #319ddb } @@ -165,6 +161,6 @@ canvas { } .rulestable { - table-layout: fixed; word-wrap: break-word -} - + table-layout: fixed; + word-wrap: break-word +} \ No newline at end of file diff --git a/summary.txt.ejs b/summary.txt.ejs index b1ae34c..b5e5421 100644 --- a/summary.txt.ejs +++ b/summary.txt.ejs @@ -11,24 +11,20 @@ Delta analysis: <%= deltaAnalysis %> New Code Period: <%= inNewCodePeriod %> <%_ } _%> <%_ if (qualityGateStatus) { _%> -Quality gate status: <%= qualityGateStatus.projectStatus.status %> on <%= qualityGateStatus.projectStatus.period?.date %> (<%= qualityGateStatus.projectStatus.period?.parameter %>)< +Quality gate status: <%= qualityGateStatus.projectStatus.status %> on <%= qualityGateStatus.projectStatus.period?.date %> (<%= qualityGateStatus.projectStatus.period?.parameter %>) - <%_ for (const condition of qualityGateStatus.projectStatus.conditions) { _%> -Metric: <%= condition.metricKey %>