Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -447,7 +447,7 @@ private void addTagHistory(Element clientAuditTrail, String tagId, String tagVal
tagHistory.appendChild(editTime);

Element username = auditDoc.createElementNS(AUDIT_NAMESPACE_URI, "Username");
username.setTextContent("Fortify Aviator");
username.setTextContent(Constants.USER_NAME);
tagHistory.appendChild(username);

clientAuditTrail.appendChild(tagHistory);
Expand Down Expand Up @@ -501,7 +501,7 @@ private String updateOrAddComment(Element issueElement, String commentText) {
commentElement.appendChild(contentElement);

Element usernameElement = auditDoc.createElementNS(AUDIT_NAMESPACE_URI, "Username");
usernameElement.setTextContent("Fortify Aviator");
usernameElement.setTextContent(Constants.USER_NAME);
commentElement.appendChild(usernameElement);

SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX");
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ public class Constants {
public static final String FOD_TAG_ID = "604f0fbe-b5fe-47cd-a9cb-587ad8ebe93a";

// User Names
public static final String USER_NAME = "Fortify Aviator";
public static final String USER_NAME = "Fortify Remediation Aviator";

// Other Constants
public static final String AUDIT_NAMESPACE_URI = "xmlns://www.fortify.com/schema/audit";
Expand All @@ -56,8 +56,8 @@ public class Constants {
//Limiting Constants
public static final int MAX_PER_CATEGORY = 500;
public static final int MAX_TOTAL = 2500;
public static final String MAX_PER_CATEGORY_EXCEEDED = "Fortify detected {issues_new_in_category} new issues in this (sub)category. Fortify Aviator auditing was limited to the first {MAX_PER_CATEGORY}.";
public static final String MAX_TOTAL_EXCEEDED = "Fortify detected {issues_new_total} new issues. Fortify Aviator auditing was limited to {MAX_TOTAL} issues in total, while ensuring that representative issues in each category were audited.";
public static final String MAX_PER_CATEGORY_EXCEEDED = "Fortify detected {issues_new_in_category} new issues in this (sub)category. Fortify Remediation Aviator auditing was limited to the first {MAX_PER_CATEGORY}.";
public static final String MAX_TOTAL_EXCEEDED = "Fortify detected {issues_new_total} new issues. Fortify Remediation Aviator auditing was limited to {MAX_TOTAL} issues in total, while ensuring that representative issues in each category were audited.";

// Operation constants for error messages
public static final String OP_CREATE_APP = "application creation";
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ public Path getPath(String internalPath) {
public void validate() {
if (!Files.exists(getPath("/audit.fvdl"))) {
if (Files.exists(getPath("/webinspect.xml"))) {
throw new AviatorSimpleException("Invalid FPR: The provided file is a DAST (WebInspect) scan result. Fortify Aviator requires an FPR from a SAST scan.");
throw new AviatorSimpleException("Invalid FPR: The provided file is a DAST (WebInspect) scan result. Fortify Remediation Aviator requires an FPR from a SAST scan.");
}
throw new AviatorSimpleException("Invalid FPR: The file does not contain 'audit.fvdl' and does not appear to be a valid SAST scan result.");
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
Expand Down Expand Up @@ -83,6 +84,24 @@ void testUpdateAndSaveSuppressesNonExcludedCategory() throws Exception {
assertEquals("true", readIssueElement().getAttribute("suppressed"));
}

@Test
void testUpdateAndSaveUsesFortifyRemediationAviatorUserName() throws Exception {
createTestFpr(createAuditXml(false));
AuditProcessor auditProcessor = new AuditProcessor(fprHandle);
auditProcessor.processAuditXML();

auditProcessor.updateAndSaveAuditAndRemediationsXml(
Map.of("instance-1", createFalsePositiveResponse()),
createTagMappingConfig("Privacy Violation"),
Map.of("instance-1", "Cross-Site Scripting"),
new FPRInfo(fprHandle));

List<String> usernames = readUsernames();
assertEquals("Fortify Remediation Aviator", Constants.USER_NAME);
assertTrue(usernames.size() >= 2);
assertTrue(usernames.stream().allMatch(Constants.USER_NAME::equals));
}

@Test
void testUpdateAndSaveThrowsClearErrorWhenCategoryLookupMissing() throws Exception {
createTestFpr(createAuditXml(false));
Expand Down Expand Up @@ -130,6 +149,22 @@ private Element readIssueElement() throws Exception {
return (Element) document.getElementsByTagNameNS("xmlns://www.fortify.com/schema/audit", "Issue").item(0);
}

private List<String> readUsernames() throws Exception {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
Document document;
try (var inputStream = Files.newInputStream(fprHandle.getPath("/audit.xml"))) {
document = factory.newDocumentBuilder().parse(inputStream);
}

var usernames = new ArrayList<String>();
var nodes = document.getElementsByTagNameNS("xmlns://www.fortify.com/schema/audit", "Username");
for (int i = 0; i < nodes.getLength(); i++) {
usernames.add(nodes.item(i).getTextContent());
}
return usernames;
}

private AuditResponse createFalsePositiveResponse() {
return AuditResponse.builder()
.issueId("instance-1")
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ private JsonNode getTagDefinitionForCreate() {
ObjectNode tagNode = JsonHelper.getObjectMapper().createObjectNode();
tagNode.put("name", tagDef.getName());
tagNode.put("guid", tagDef.getGuid());
tagNode.put("description", "Custom tag for Fortify Aviator.");
tagNode.put("description", "Custom tag for Fortify Remediation Aviator.");
tagNode.put("valueType", tagDef.getValueType());
tagNode.put("customTagType", "CUSTOM");
// LIST tags need a populated valueList; TEXT tags use an empty array
Expand Down
Loading
Loading