Apply to v5.0 and also to generate-all for 4.0 #1

tghosth · 2023-07-06T08:05:45Z

No description provided.

sonatype-lift · 2023-07-06T08:07:56Z

5.0/tools/cyclonedx.py

+    Converts the ASVS JSON into CycloneDX Standards format
+    Copyright (c) 2023 OWASP Foundation
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy


E501: line too long (80 > 79 characters)

❗❗ 41 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

5.0/tools/cyclonedx.py 9

5.0/tools/cyclonedx.py 10

5.0/tools/cyclonedx.py 15

5.0/tools/cyclonedx.py 22

5.0/tools/cyclonedx.py 23

5.0/tools/cyclonedx.py 45

5.0/tools/cyclonedx.py 50

5.0/tools/cyclonedx.py 66

5.0/tools/cyclonedx.py 78

5.0/tools/cyclonedx.py 81

Showing 10 of 41 findings. Visit the Lift Web Console to see all.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:07:59Z

5.0/tools/cyclonedx.py

+    '''
+
+import json
+from dicttoxml2 import dicttoxml


F401: 'dicttoxml2.dicttoxml' imported but unused

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:00Z

5.0/tools/cyclonedx.py

+try:
+    from StringIO import StringIO
+except ImportError:
+    from io import StringIO


F401: 'io.StringIO' imported but unused

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:02Z

5.0/tools/cyclonedx.py

+    bom['metadata']['licenses'][0]['license']['url'] = "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt"
+    bom['metadata']['supplier'] = {}
+    bom['metadata']['supplier']['name'] = "OWASP Foundation"
+    bom['metadata']['supplier']['url'] = [ "https://owasp.org" ]


E201: whitespace after '['

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:04Z

5.0/tools/cyclonedx.py

+    bom['metadata']['licenses'][0]['license']['url'] = "https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt"
+    bom['metadata']['supplier'] = {}
+    bom['metadata']['supplier']['name'] = "OWASP Foundation"
+    bom['metadata']['supplier']['url'] = [ "https://owasp.org" ]


E202: whitespace before ']'

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:06Z

5.0/tools/cyclonedx.py

+
+    def to_json(self):
+        ''' Returns a JSON-formatted string '''
+        return json.dumps(self.bom, indent = 2, sort_keys = False, ensure_ascii=False).strip()


E251: unexpected spaces around keyword / parameter equals

❗❗ 3 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

5.0/tools/cyclonedx.py 142

5.0/tools/cyclonedx.py 142

5.0/tools/cyclonedx.py 142

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:08Z

5.0/tools/cyclonedx.py

+    '''
+
+import json
+from dicttoxml2 import dicttoxml


reportMissingImports: Import "dicttoxml2" could not be resolved

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:10Z

5.0/tools/cyclonedx.py

+import datetime
+import uuid
+try:
+    from StringIO import StringIO


reportMissingImports: Import "StringIO" could not be resolved

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:12Z

5.0/tools/export.py

@@ -30,9 +30,10 @@

 import argparse
 from asvs import ASVS
+from cyclonedx import CycloneDX


reportGeneralTypeIssues: "CycloneDX" is unknown import symbol

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-07-06T08:08:15Z

4.0/generate-all.sh

@@ -17,6 +17,7 @@ for lang in ${LANGS}; do
    verslong="./docs_$lang/OWASP Application Security Verification Standard $vers-$lang"

    python3 tools/export.py --format json --language $lang > "$verslong.json"
+    python3 tools/export.py --format cdx_json --language $lang > "$verslong.cdx.json"


SC2086: Double quote to prevent globbing and word splitting.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

tghosth · 2023-07-06T08:38:46Z

Your bot has gone a little mad but I made some minor changes to your PR @stevespringett

stevespringett · 2023-09-07T04:00:51Z

Fantastic. Thank you.

Apply to v5.0 and also to generate-all for 4.0

fb00544

sonatype-lift bot reviewed Jul 6, 2023

View reviewed changes

tghosth marked this pull request as draft July 6, 2023 08:17

tghosth marked this pull request as ready for review July 6, 2023 08:38

tghosth mentioned this pull request Jul 9, 2023

Added POC for CycloneDX v1.6 (snapshot) standard support OWASP/ASVS#1676

Merged

stevespringett merged commit 6af13e5 into stevespringett:master Sep 7, 2023

tghosth deleted the patch-1 branch September 7, 2023 09:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Apply to v5.0 and also to generate-all for 4.0 #1

Apply to v5.0 and also to generate-all for 4.0 #1

tghosth commented Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

sonatype-lift bot Jul 6, 2023

tghosth commented Jul 6, 2023 •

edited

Loading

stevespringett commented Sep 7, 2023

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

Apply to v5.0 and also to generate-all for 4.0 #1

Apply to v5.0 and also to generate-all for 4.0 #1

Conversation

tghosth commented Jul 6, 2023

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jul 6, 2023

Choose a reason for hiding this comment

tghosth commented Jul 6, 2023 • edited Loading

stevespringett commented Sep 7, 2023

tghosth commented Jul 6, 2023 •

edited

Loading