1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 package org.owasp.dependencycheck.reporting;
19
20 import io.github.jeremylong.openvulnerability.client.nvd.CvssV2;
21 import io.github.jeremylong.openvulnerability.client.nvd.CvssV3;
22 import io.github.jeremylong.openvulnerability.client.nvd.CvssV4;
23
24
25
26
27
28 public class SarifRule {
29
30
31
32
33 private String id;
34
35
36
37 private String shortDescription;
38
39
40
41 private String fullDescription;
42
43
44
45 private String name;
46
47
48
49 private String cvssv2Score;
50
51
52
53 private String cvssv2AccessVector;
54
55
56
57 private String cvssv2AccessComplexity;
58
59
60
61 private String cvssv2Authentication;
62
63
64
65 private String cvssv2ConfidentialityImpact;
66
67
68
69 private String cvssv2IntegrityImpact;
70
71
72
73 private String cvssv2AvailabilityImpact;
74
75
76
77 private String cvssv2Severity;
78
79
80
81 private String cvssv2Version;
82
83
84
85 private String cvssv2ExploitabilityScore;
86
87
88
89 private String cvssv2ImpactScore;
90
91
92
93 private String cvssv3BaseScore;
94
95
96
97 private String cvssv3AttackVector;
98
99
100
101 private String cvssv3AttackComplexity;
102
103
104
105 private String cvssv3PrivilegesRequired;
106
107
108
109 private String cvssv3UserInteraction;
110
111
112
113 private String cvssv3Scope;
114
115
116
117 private String cvssv3ConfidentialityImpact;
118
119
120
121 private String cvssv3IntegrityImpact;
122
123
124
125 private String cvssv3AvailabilityImpact;
126
127
128
129 private String cvssv3BaseSeverity;
130
131
132
133 private String cvssv3ExploitabilityScore;
134
135
136
137 private String cvssv3ImpactScore;
138
139
140
141 private String cvssv3Version;
142
143
144
145 private String cvssv4BaseScore;
146
147
148
149 private String cvssv4Vector;
150
151
152
153 private String source;
154
155
156
157
158
159
160
161
162
163
164
165
166 public SarifRule(String name, String shortDescription, String fullDescription,
167 String source, CvssV2 cvssV2, CvssV3 cvssV3, CvssV4 cvssV4) {
168 this.id = name;
169 this.name = name;
170 this.shortDescription = shortDescription;
171 this.fullDescription = fullDescription;
172 this.source = source;
173 if (cvssV2 != null) {
174 if (cvssV2.getCvssData().getBaseScore() != null) {
175 this.cvssv2Score = cvssV2.getCvssData().getBaseScore().toString();
176 }
177 if (cvssV2.getCvssData().getAccessVector() != null) {
178 this.cvssv2AccessVector = cvssV2.getCvssData().getAccessVector().name();
179 }
180 if (cvssV2.getCvssData().getAccessComplexity() != null) {
181 this.cvssv2AccessComplexity = cvssV2.getCvssData().getAccessComplexity().name();
182 }
183 if (cvssV2.getCvssData().getAuthentication() != null) {
184 this.cvssv2Authentication = cvssV2.getCvssData().getAuthentication().name();
185 }
186 if (cvssV2.getCvssData().getConfidentialityImpact() != null) {
187 this.cvssv2ConfidentialityImpact = cvssV2.getCvssData().getConfidentialityImpact().name();
188 }
189 if (cvssV2.getCvssData().getIntegrityImpact() != null) {
190 this.cvssv2IntegrityImpact = cvssV2.getCvssData().getIntegrityImpact().name();
191 }
192 if (cvssV2.getCvssData().getAvailabilityImpact() != null) {
193 this.cvssv2AvailabilityImpact = cvssV2.getCvssData().getAvailabilityImpact().name();
194 }
195 this.cvssv2Severity = cvssV2.getCvssData().getBaseSeverity();
196 if (cvssV2.getCvssData().getVersion() != null) {
197 this.cvssv2Version = cvssV2.getCvssData().getVersion().name();
198 }
199 if (cvssV2.getExploitabilityScore() != null) {
200 this.cvssv2ExploitabilityScore = cvssV2.getExploitabilityScore().toString();
201 }
202 if (cvssV2.getImpactScore() != null) {
203 this.cvssv2ImpactScore = cvssV2.getImpactScore().toString();
204 }
205 }
206 if (cvssV3 != null) {
207 if (cvssV3.getCvssData().getBaseScore() != null) {
208 this.cvssv3BaseScore = cvssV3.getCvssData().getBaseScore().toString();
209 }
210 if (cvssV3.getCvssData().getAttackVector() != null) {
211 this.cvssv3AttackVector = cvssV3.getCvssData().getAttackVector().name();
212 }
213 if (cvssV3.getCvssData().getAttackComplexity() != null) {
214 this.cvssv3AttackComplexity = cvssV3.getCvssData().getAttackComplexity().name();
215 }
216 if (cvssV3.getCvssData().getPrivilegesRequired() != null) {
217 this.cvssv3PrivilegesRequired = cvssV3.getCvssData().getPrivilegesRequired().name();
218 }
219 if (cvssV3.getCvssData().getUserInteraction() != null) {
220 this.cvssv3UserInteraction = cvssV3.getCvssData().getUserInteraction().name();
221 }
222 if (cvssV3.getCvssData().getScope() != null) {
223 this.cvssv3Scope = cvssV3.getCvssData().getScope().name();
224 }
225 if (cvssV3.getCvssData().getConfidentialityImpact() != null) {
226 this.cvssv3ConfidentialityImpact = cvssV3.getCvssData().getConfidentialityImpact().name();
227 }
228 if (cvssV3.getCvssData().getIntegrityImpact() != null) {
229 this.cvssv3IntegrityImpact = cvssV3.getCvssData().getIntegrityImpact().name();
230 }
231 if (cvssV3.getCvssData().getAvailabilityImpact() != null) {
232 this.cvssv3AvailabilityImpact = cvssV3.getCvssData().getAvailabilityImpact().name();
233 }
234 if (cvssV3.getCvssData().getBaseSeverity() != null) {
235 this.cvssv3BaseSeverity = cvssV3.getCvssData().getBaseSeverity().name();
236 }
237 if (cvssV3.getExploitabilityScore() != null) {
238 this.cvssv3ExploitabilityScore = cvssV3.getExploitabilityScore().toString();
239 }
240 if (cvssV3.getImpactScore() != null) {
241 this.cvssv3ImpactScore = cvssV3.getImpactScore().toString();
242 }
243 this.cvssv3Version = cvssV3.getCvssData().getVersion().name();
244 }
245 if (cvssV4 != null && cvssV4.getCvssData() != null) {
246 if (cvssV4.getCvssData().getBaseScore() != null) {
247 this.cvssv4BaseScore = cvssV4.getCvssData().getBaseScore().toString();
248 }
249 this.cvssv4Vector = cvssV4.toString();
250 }
251 }
252
253
254
255
256
257
258 public String getSource() {
259 return source;
260 }
261
262
263
264
265
266
267 public void setSource(String source) {
268 this.source = source;
269 }
270
271
272
273
274
275
276 public String getCvssv3Version() {
277 return cvssv3Version;
278 }
279
280
281
282
283
284
285 public void setCvssv3Version(String cvssv3Version) {
286 this.cvssv3Version = cvssv3Version;
287 }
288
289
290
291
292
293
294 public String getCvssv3ImpactScore() {
295 return cvssv3ImpactScore;
296 }
297
298
299
300
301
302
303 public void setCvssv3ImpactScore(String cvssv3ImpactScore) {
304 this.cvssv3ImpactScore = cvssv3ImpactScore;
305 }
306
307
308
309
310
311
312 public String getCvssv3ExploitabilityScore() {
313 return cvssv3ExploitabilityScore;
314 }
315
316
317
318
319
320
321 public void setCvssv3ExploitabilityScore(String cvssv3ExploitabilityScore) {
322 this.cvssv3ExploitabilityScore = cvssv3ExploitabilityScore;
323 }
324
325
326
327
328
329
330 public String getCvssv3BaseSeverity() {
331 return cvssv3BaseSeverity;
332 }
333
334
335
336
337
338
339 public void setCvssv3BaseSeverity(String cvssv3BaseSeverity) {
340 this.cvssv3BaseSeverity = cvssv3BaseSeverity;
341 }
342
343
344
345
346
347
348 public String getCvssv3AvailabilityImpact() {
349 return cvssv3AvailabilityImpact;
350 }
351
352
353
354
355
356
357 public void setCvssv3AvailabilityImpact(String cvssv3AvailabilityImpact) {
358 this.cvssv3AvailabilityImpact = cvssv3AvailabilityImpact;
359 }
360
361
362
363
364
365
366 public String getCvssv3IntegrityImpact() {
367 return cvssv3IntegrityImpact;
368 }
369
370
371
372
373
374
375 public void setCvssv3IntegrityImpact(String cvssv3IntegrityImpact) {
376 this.cvssv3IntegrityImpact = cvssv3IntegrityImpact;
377 }
378
379
380
381
382
383
384 public String getCvssv3ConfidentialityImpact() {
385 return cvssv3ConfidentialityImpact;
386 }
387
388
389
390
391
392
393
394 public void setCvssv3ConfidentialityImpact(String cvssv3ConfidentialityImpact) {
395 this.cvssv3ConfidentialityImpact = cvssv3ConfidentialityImpact;
396 }
397
398
399
400
401
402
403 public String getCvssv3Scope() {
404 return cvssv3Scope;
405 }
406
407
408
409
410
411
412 public void setCvssv3Scope(String cvssv3Scope) {
413 this.cvssv3Scope = cvssv3Scope;
414 }
415
416
417
418
419
420
421 public String getCvssv3UserInteraction() {
422 return cvssv3UserInteraction;
423 }
424
425
426
427
428
429
430 public void setCvssv3UserInteraction(String cvssv3UserInteraction) {
431 this.cvssv3UserInteraction = cvssv3UserInteraction;
432 }
433
434
435
436
437
438
439 public String getCvssv3PrivilegesRequired() {
440 return cvssv3PrivilegesRequired;
441 }
442
443
444
445
446
447
448 public void setCvssv3PrivilegesRequired(String cvssv3PrivilegesRequired) {
449 this.cvssv3PrivilegesRequired = cvssv3PrivilegesRequired;
450 }
451
452
453
454
455
456
457 public String getCvssv3AttackComplexity() {
458 return cvssv3AttackComplexity;
459 }
460
461
462
463
464
465
466 public void setCvssv3AttackComplexity(String cvssv3AttackComplexity) {
467 this.cvssv3AttackComplexity = cvssv3AttackComplexity;
468 }
469
470
471
472
473
474
475 public String getCvssv3AttackVector() {
476 return cvssv3AttackVector;
477 }
478
479
480
481
482
483
484 public void setCvssv3AttackVector(String cvssv3AttackVector) {
485 this.cvssv3AttackVector = cvssv3AttackVector;
486 }
487
488
489
490
491
492
493 public String getCvssv3BaseScore() {
494 return cvssv3BaseScore;
495 }
496
497
498
499
500
501
502 public void setCvssv3BaseScore(String cvssv3BaseScore) {
503 this.cvssv3BaseScore = cvssv3BaseScore;
504 }
505
506
507
508
509
510
511 public String getCvssv2ImpactScore() {
512 return cvssv2ImpactScore;
513 }
514
515
516
517
518
519
520 public void setCvssv2ImpactScore(String cvssv2ImpactScore) {
521 this.cvssv2ImpactScore = cvssv2ImpactScore;
522 }
523
524
525
526
527
528
529 public String getCvssv2ExploitabilityScore() {
530 return cvssv2ExploitabilityScore;
531 }
532
533
534
535
536
537
538 public void setCvssv2ExploitabilityScore(String cvssv2ExploitabilityScore) {
539 this.cvssv2ExploitabilityScore = cvssv2ExploitabilityScore;
540 }
541
542
543
544
545
546
547 public String getCvssv2Version() {
548 return cvssv2Version;
549 }
550
551
552
553
554
555
556 public void setCvssv2Version(String cvssv2Version) {
557 this.cvssv2Version = cvssv2Version;
558 }
559
560
561
562
563
564
565 public String getCvssv2Severity() {
566 return cvssv2Severity;
567 }
568
569
570
571
572
573
574 public void setCvssv2Severity(String cvssv2Severity) {
575 this.cvssv2Severity = cvssv2Severity;
576 }
577
578
579
580
581
582
583 public String getCvssv2AvailabilityImpact() {
584 return cvssv2AvailabilityImpact;
585 }
586
587
588
589
590
591
592 public void setCvssv2AvailabilityImpact(String cvssv2AvailabilityImpact) {
593 this.cvssv2AvailabilityImpact = cvssv2AvailabilityImpact;
594 }
595
596
597
598
599
600
601 public String getCvssv2IntegrityImpact() {
602 return cvssv2IntegrityImpact;
603 }
604
605
606
607
608
609
610 public void setCvssv2IntegrityImpact(String cvssv2IntegrityImpact) {
611 this.cvssv2IntegrityImpact = cvssv2IntegrityImpact;
612 }
613
614
615
616
617
618
619 public String getCvssv2ConfidentialityImpact() {
620 return cvssv2ConfidentialityImpact;
621 }
622
623
624
625
626
627
628 public void setCvssv2ConfidentialityImpact(String cvssv2ConfidentialityImpact) {
629 this.cvssv2ConfidentialityImpact = cvssv2ConfidentialityImpact;
630 }
631
632
633
634
635
636
637 public String getCvssv2Authentication() {
638 return cvssv2Authentication;
639 }
640
641
642
643
644
645
646 public void setCvssv2Authentication(String cvssv2Authentication) {
647 this.cvssv2Authentication = cvssv2Authentication;
648 }
649
650
651
652
653
654
655 public String getCvssv2AccessComplexity() {
656 return cvssv2AccessComplexity;
657 }
658
659
660
661
662
663
664 public void setCvssv2AccessComplexity(String cvssv2AccessComplexity) {
665 this.cvssv2AccessComplexity = cvssv2AccessComplexity;
666 }
667
668
669
670
671
672
673 public String getCvssv2AccessVector() {
674 return cvssv2AccessVector;
675 }
676
677
678
679
680
681
682 public void setCvssv2AccessVector(String cvssv2AccessVector) {
683 this.cvssv2AccessVector = cvssv2AccessVector;
684 }
685
686
687
688
689
690
691 public String getCvssv2Score() {
692 return cvssv2Score;
693 }
694
695
696
697
698
699
700 public void setCvssv2Score(String cvssv2Score) {
701 this.cvssv2Score = cvssv2Score;
702 }
703
704
705
706
707
708
709 public String getName() {
710 return name;
711 }
712
713
714
715
716
717
718 public void setName(String name) {
719 this.name = name;
720 }
721
722
723
724
725
726
727 public String getFullDescription() {
728 return fullDescription;
729 }
730
731
732
733
734
735
736 public void setFullDescription(String fullDescription) {
737 this.fullDescription = fullDescription;
738 }
739
740
741
742
743
744
745 public String getShortDescription() {
746 return shortDescription;
747 }
748
749
750
751
752
753
754 public void setShortDescription(String shortDescription) {
755 this.shortDescription = shortDescription;
756 }
757
758
759
760
761
762
763 public String getId() {
764 return id;
765 }
766
767
768
769
770
771
772 public void setId(String id) {
773 this.id = id;
774 }
775
776
777
778
779
780
781 public String getCvssv4BaseScore() {
782 return cvssv4BaseScore;
783 }
784
785
786
787
788
789 public void setCvssv4BaseScore(String cvssv4BaseScore) {
790 this.cvssv4BaseScore = cvssv4BaseScore;
791 }
792
793
794
795
796
797 public String getCvssv4Vector() {
798 return cvssv4Vector;
799 }
800
801
802
803
804
805 public void setCvssv4Vector(String cvssv4Vector) {
806 this.cvssv4Vector = cvssv4Vector;
807 }
808 }