Skip to content

Commit ac8946d

Browse files
jperezdealgabajperezdealgaba
committed
tests/csgrep: added tests for column property in Coverity JSONv10
Related https://issues.redhat.com/browse/OSH-11 Added tests for the column property in Coverity using JSON v10 results. Two different tests cases have been added: IN one of them, the column number is present in the results. In the second one, the column number is null
1 parent 1461144 commit ac8946d

4 files changed

+267
-0
lines changed

‎tests/csgrep/0122-json-parser-cov-v10-column-args.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
--mode=json

‎tests/csgrep/0122-json-parser-cov-v10-column-stdin.txt

+195
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
{
2+
"type" : "Coverity issues",
3+
"formatVersion" : 10,
4+
"suppressedIssueCount" : 0,
5+
"issues" : [
6+
{
7+
"mergeKey" : "0d67db2be2df7aa477796bac827f024b",
8+
"occurrenceCountForMK" : 1,
9+
"occurrenceNumberInMK" : 1,
10+
"referenceOccurrenceCountForMK" : null,
11+
"checkerName" : "HARDCODED_CREDENTIALS",
12+
"subcategory" : "none",
13+
"type" : "hardcoded_credentials",
14+
"code-language" : "python",
15+
"extra" : "\"app\",\"secret_key\"",
16+
"domain" : "OTHER",
17+
"language" : "Python 3",
18+
"mainEventFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
19+
"strippedMainEventFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
20+
"mainEventLineNumber" : 56,
21+
"mainEventColumnNumber" : 1,
22+
"properties" : {},
23+
"functionDisplayName" : "<script>",
24+
"functionMangledName" : "!productpage.py!%SCRIPT",
25+
"functionHtmlDisplayName" : "!productpage.py!%SCRIPT",
26+
"functionSimpleName" : "function",
27+
"functionSearchName" : "<script>",
28+
"localStatus" : null,
29+
"ordered" : true,
30+
"events" : [
31+
{
32+
"covLStrEventDescription" : "{CovLStrv2{{t{Assigning: {0} = {1}.}{{code{app}}}{{code{Flask(__name__)}}}}}}",
33+
"eventDescription" : "Assigning: \"app\" = \"Flask(__name__)\".",
34+
"eventNumber" : 1,
35+
"eventTreePosition" : "1",
36+
"eventSet" : 0,
37+
"eventTag" : "assign",
38+
"filePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
39+
"strippedFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
40+
"lineNumber" : 47,
41+
"columnNumber" : 1,
42+
"main" : false,
43+
"moreInformationId" : null,
44+
"remediation" : false,
45+
"events" : null
46+
},
47+
{
48+
"covLStrEventDescription" : "{CovLStrv2{{t{Assigning: {0} = {1}.}{{code{app.secret_key}}}{{code{b\"_5#y2L\\\"F4Q8z\\n\\xec]/\"}}}}}}",
49+
"eventDescription" : "Assigning: \"app.secret_key\" = \"b\"_5#y2L\\\"F4Q8z\\n\\xec]/\"\".",
50+
"eventNumber" : 2,
51+
"eventTreePosition" : "2",
52+
"eventSet" : 0,
53+
"eventTag" : "assign",
54+
"filePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
55+
"strippedFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
56+
"lineNumber" : 56,
57+
"columnNumber" : 1,
58+
"main" : false,
59+
"moreInformationId" : null,
60+
"remediation" : false,
61+
"events" : null
62+
},
63+
{
64+
"covLStrEventDescription" : "{CovLStrv2{{t{{0} uses the constant string as credentials.}{{code{app.secret_key}}}}}}",
65+
"eventDescription" : "\"app.secret_key\" uses the constant string as credentials.",
66+
"eventNumber" : 3,
67+
"eventTreePosition" : "3",
68+
"eventSet" : 0,
69+
"eventTag" : "credentials_use",
70+
"filePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
71+
"strippedFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
72+
"lineNumber" : 56,
73+
"columnNumber" : 1,
74+
"main" : true,
75+
"moreInformationId" : null,
76+
"remediation" : false,
77+
"events" : null
78+
},
79+
{
80+
"covLStrEventDescription" : "{CovLStrv2{{t{Credentials should be stored in a configuration file or database that is inaccessible to unauthorized users.}}}}",
81+
"eventDescription" : "Credentials should be stored in a configuration file or database that is inaccessible to unauthorized users.",
82+
"eventNumber" : 4,
83+
"eventTreePosition" : "4",
84+
"eventSet" : 0,
85+
"eventTag" : "remediation",
86+
"filePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
87+
"strippedFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
88+
"lineNumber" : 56,
89+
"columnNumber" : 1,
90+
"main" : false,
91+
"moreInformationId" : null,
92+
"remediation" : true,
93+
"events" : null
94+
}
95+
],
96+
"stateOnServer" : null,
97+
"localTriage" : null,
98+
"checkerProperties" : {
99+
"category" : "Medium impact security",
100+
"categoryDescription" : "Medium impact security",
101+
"cweCategory" : "798",
102+
"weaknessIdCategory" : "410",
103+
"issueKinds" : [
104+
"SECURITY"
105+
],
106+
"eventSetCaptions" : [],
107+
"impact" : "Medium",
108+
"impactDescription" : "Medium",
109+
"subcategoryLocalEffect" : "Users with access to this source code can use these credentials to access production services or data. Changing these credentials requires changing the code and re-deploying the application.",
110+
"subcategoryShortDescription" : "Use of hard-coded credentials",
111+
"subcategoryLongDescription" : "Credentials are stored directly in the source code"
112+
}
113+
},
114+
{
115+
"mergeKey" : "0b1c337fa107a6e55fcc49555eaa2f90",
116+
"occurrenceCountForMK" : 1,
117+
"occurrenceNumberInMK" : 1,
118+
"referenceOccurrenceCountForMK" : null,
119+
"checkerName" : "SIGMA.access_to_secret",
120+
"subcategory" : "kubernetes",
121+
"type" : "sigma.access_to_secret",
122+
"subtype" : "kubernetes",
123+
"code-language" : "text",
124+
"extra" : "access_to_secret_kubernetes -- istio-discovery/templates/role.yaml -- ##Σ-markup - ##Σ-markup - rules - ##Σ-markup",
125+
"domain" : "OTHER",
126+
"language" : "Text",
127+
"mainEventFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
128+
"strippedMainEventFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
129+
"mainEventLineNumber" : 17,
130+
"mainEventColumnNumber" : null,
131+
"properties" : {},
132+
"functionDisplayName" : null,
133+
"functionMangledName" : null,
134+
"functionHtmlDisplayName" : null,
135+
"functionSimpleName" : null,
136+
"functionSearchName" : null,
137+
"localStatus" : null,
138+
"ordered" : true,
139+
"events" : [
140+
{
141+
"covLStrEventDescription" : "The `secrets` resource is granted `get`, `list`, or `watch` access on the Kubernetes API. This can allow an attacker to view Kubernetes cluster or external resources whose credentials are stored in `secrets`.",
142+
"eventDescription" : "The `secrets` resource is granted `get`, `list`, or `watch` access on the Kubernetes API. This can allow an attacker to view Kubernetes cluster or external resources whose credentials are stored in `secrets`.",
143+
"eventNumber" : 1,
144+
"eventTreePosition" : "1",
145+
"eventSet" : 0,
146+
"eventTag" : "Sigma main event",
147+
"filePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
148+
"strippedFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
149+
"lineNumber" : 17,
150+
"columnNumber" : null,
151+
"main" : true,
152+
"moreInformationId" : null,
153+
"remediation" : false,
154+
"events" : null
155+
},
156+
{
157+
"covLStrEventDescription" : "Avoid granting `get`, `list`, or `watch` permissions for `secrets`.",
158+
"eventDescription" : "Avoid granting `get`, `list`, or `watch` permissions for `secrets`.",
159+
"eventNumber" : 2,
160+
"eventTreePosition" : "2",
161+
"eventSet" : 0,
162+
"eventTag" : "remediation",
163+
"filePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
164+
"strippedFilePathname" : "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
165+
"lineNumber" : 17,
166+
"columnNumber" : null,
167+
"main" : false,
168+
"moreInformationId" : null,
169+
"remediation" : true,
170+
"events" : null
171+
}
172+
],
173+
"stateOnServer" : null,
174+
"localTriage" : null,
175+
"checkerProperties" : {
176+
"category" : "Sigma",
177+
"categoryDescription" : "Sigma",
178+
"cweCategory" : "284",
179+
"weaknessIdCategory" : "none",
180+
"issueKinds" : [
181+
"SECURITY"
182+
],
183+
"eventSetCaptions" : [],
184+
"impact" : "Low",
185+
"impactDescription" : "Low",
186+
"subcategoryLocalEffect" : "",
187+
"subcategoryShortDescription" : "Access to secret",
188+
"subcategoryLongDescription" : "The `secrets` resource is granted `get`, `list`, or `watch` access on the Kubernetes API. This can allow an attacker to view Kubernetes cluster or external resources whose credentials are stored in `secrets`."
189+
}
190+
}
191+
],
192+
"desktopAnalysisSettings" : null,
193+
"error" : null,
194+
"warnings" : []
195+
}

‎tests/csgrep/0122-json-parser-cov-v10-column-stdout.txt

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"defects": [
3+
{
4+
"checker": "HARDCODED_CREDENTIALS",
5+
"cwe": 798,
6+
"function": "<script>",
7+
"language": "python",
8+
"tool": "coverity",
9+
"key_event_idx": 2,
10+
"events": [
11+
{
12+
"file_name": "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
13+
"line": 47,
14+
"column": 1,
15+
"event": "assign",
16+
"message": "Assigning: \"app\" = \"Flask(__name__)\".",
17+
"verbosity_level": 1
18+
},
19+
{
20+
"file_name": "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
21+
"line": 56,
22+
"column": 1,
23+
"event": "assign",
24+
"message": "Assigning: \"app.secret_key\" = \"b\"_5#y2L\\\"F4Q8z\\n\\xec]/\"\".",
25+
"verbosity_level": 1
26+
},
27+
{
28+
"file_name": "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
29+
"line": 56,
30+
"column": 1,
31+
"event": "credentials_use",
32+
"message": "\"app.secret_key\" uses the constant string as credentials.",
33+
"verbosity_level": 0
34+
},
35+
{
36+
"file_name": "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/samples/bookinfo/src/productpage/productpage.py",
37+
"line": 56,
38+
"column": 1,
39+
"event": "remediation",
40+
"message": "Credentials should be stored in a configuration file or database that is inaccessible to unauthorized users.",
41+
"verbosity_level": 1
42+
}
43+
]
44+
},
45+
{
46+
"checker": "SIGMA.access_to_secret",
47+
"cwe": 284,
48+
"function": "null",
49+
"language": "text",
50+
"tool": "coverity",
51+
"key_event_idx": 0,
52+
"events": [
53+
{
54+
"file_name": "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
55+
"line": 17,
56+
"event": "Sigma main event",
57+
"message": "The `secrets` resource is granted `get`, `list`, or `watch` access on the Kubernetes API. This can allow an attacker to view Kubernetes cluster or external resources whose credentials are stored in `secrets`.",
58+
"verbosity_level": 0
59+
},
60+
{
61+
"file_name": "/tmp/cspodmanu0m_p6ko/istio-proxyv2/unpacked_remote_sources/istio/app/manifests/charts/istio-control/istio-discovery/templates/role.yaml",
62+
"line": 17,
63+
"event": "remediation",
64+
"message": "Avoid granting `get`, `list`, or `watch` permissions for `secrets`.",
65+
"verbosity_level": 1
66+
}
67+
]
68+
}
69+
]
70+
}

‎tests/csgrep/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -165,3 +165,4 @@ test_csgrep("0118-gcc-parser-ubsan-dedup" )
165165
test_csgrep("0119-cov-parser-sigma" )
166166
test_csgrep("0120-sarif-parser-semgrep" )
167167
test_csgrep("0121-cov-parser-lock-evasion" )
168+
test_csgrep("0122-json-parser-cov-v10-column" )

0 commit comments

Comments
 (0)