Support the CycloneDX vulnerability extension in Reporter #7751
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #7751 +/- ##
=========================================
Coverage 67.70% 67.70%
Complexity 2055 2055
=========================================
Files 358 358
Lines 16917 16917
Branches 2401 2401
=========================================
Hits 11453 11453
Misses 4467 4467
Partials 997 997
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
plugins/reporters/cyclonedx/src/main/kotlin/CycloneDxReporter.kt
Outdated
Show resolved
Hide resolved
| <vulnerability> | ||
| <id>CVE-2021-1234</id> | ||
| <ratings> | ||
| <rating> |
There was a problem hiding this comment.
Any idea why no severity value (should be "MEDIUM") shows up here?
There was a problem hiding this comment.
Yes, it's because of the fromString(String text) method in CycloneDX java core library, which is case-sensitive. Should I always pass the lowercase value e.g.
Severity.fromString(reference.severity?.lowercase())There was a problem hiding this comment.
Let me quickly refactor some code on our side to provide better convenience functions for this use-case. I'll keep you posted.
There was a problem hiding this comment.
Seems like you figured out yourself already how to make use of the refactored code, great! 🚀
…rter Signed-off-by: George Andrinopoulos <[email protected]>
geoandri
force-pushed
the
reporter-support-cyclonedx-vulnerabilities
branch
from
acfbea7 to
1af097e
Compare
| source = org.cyclonedx.model.vulnerability.Vulnerability.Source() | ||
| .apply { url = reference.url.toString() } | ||
| severity = org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity | ||
| .fromString(reference.severityRating.lowercase()) |
| <vulnerability> | ||
| <id>CVE-2021-1234</id> | ||
| <ratings> | ||
| <rating> |
There was a problem hiding this comment.
Seems like you figured out yourself already how to make use of the refactored code, great! 🚀
|
Merging despite the unrelated |
This PR adds support for CycloneDX vulnerabilities in Reporter.
Closes #4531