Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Port: Apply consistent formatting to SQL query #709

Merged
merged 2 commits into from
Jun 11, 2024
Merged

Port: Apply consistent formatting to SQL query #709

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c936866
Apply consistent formatting to SQL query
sahibamittal Jun 10, 2024
e5cfb8d
Update Finding.java
sahibamittal Jun 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/main/java/org/dependencytrack/integrations/kenna/KennaDataTransformer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ public void process(final Project project, final String externalId) {
final JSONArray vulns = new JSONArray();
final List<Finding> findings = qm.getFindings(project);
for (final Finding finding: findings) {
final Map analysis = finding.getAnalysis();
final Map<String, Object> analysis = finding.getAnalysis();
final Object suppressed = finding.getAnalysis().get("isSuppressed");
if (suppressed instanceof Boolean) {
final boolean isSuppressed = (Boolean)analysis.get("isSuppressed");
Expand Down
102 changes: 56 additions & 46 deletions src/main/java/org/dependencytrack/model/Finding.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,48 +53,58 @@ public class Finding implements Serializable {
* in double quotes to satisfy PostgreSQL case-sensitive requirements. This also places a requirement
* on ANSI_QUOTES mode being enabled in MySQL. SQL Server works regardless and is just happy to be invited :-)
*/
public static final String QUERY = "SELECT " +
"\"COMPONENT\".\"UUID\"," +
"\"COMPONENT\".\"NAME\"," +
"\"COMPONENT\".\"GROUP\"," +
"\"COMPONENT\".\"VERSION\"," +
"\"COMPONENT\".\"PURL\"," +
"\"COMPONENT\".\"CPE\"," +
"\"VULNERABILITY\".\"UUID\"," +
"\"VULNERABILITY\".\"SOURCE\"," +
"\"VULNERABILITY\".\"VULNID\"," +
"\"VULNERABILITY\".\"TITLE\"," +
"\"VULNERABILITY\".\"SUBTITLE\"," +
"\"VULNERABILITY\".\"DESCRIPTION\"," +
"\"VULNERABILITY\".\"RECOMMENDATION\"," +
"\"VULNERABILITY\".\"SEVERITY\"," +
"\"VULNERABILITY\".\"CVSSV2BASESCORE\"," +
"\"VULNERABILITY\".\"CVSSV3BASESCORE\"," +
"\"VULNERABILITY\".\"OWASPRRLIKELIHOODSCORE\"," +
"\"VULNERABILITY\".\"OWASPRRTECHNICALIMPACTSCORE\"," +
"\"VULNERABILITY\".\"OWASPRRBUSINESSIMPACTSCORE\"," +
"\"EPSS\".\"SCORE\"," +
"\"EPSS\".\"PERCENTILE\"," +
"\"VULNERABILITY\".\"CWES\"," +
"\"FINDINGATTRIBUTION\".\"ANALYZERIDENTITY\"," +
"\"FINDINGATTRIBUTION\".\"ATTRIBUTED_ON\"," +
"\"FINDINGATTRIBUTION\".\"ALT_ID\"," +
"\"FINDINGATTRIBUTION\".\"REFERENCE_URL\"," +
"\"ANALYSIS\".\"STATE\"," +
"\"ANALYSIS\".\"SUPPRESSED\" " +
"FROM \"COMPONENT\" " +
"INNER JOIN \"COMPONENTS_VULNERABILITIES\" ON (\"COMPONENT\".\"ID\" = \"COMPONENTS_VULNERABILITIES\".\"COMPONENT_ID\") " +
"INNER JOIN \"VULNERABILITY\" ON (\"COMPONENTS_VULNERABILITIES\".\"VULNERABILITY_ID\" = \"VULNERABILITY\".\"ID\") " +
"LEFT JOIN \"EPSS\" ON (\"VULNERABILITY\".\"VULNID\" = \"EPSS\".\"CVE\") " +
"INNER JOIN \"FINDINGATTRIBUTION\" ON (\"COMPONENT\".\"ID\" = \"FINDINGATTRIBUTION\".\"COMPONENT_ID\") AND (\"VULNERABILITY\".\"ID\" = \"FINDINGATTRIBUTION\".\"VULNERABILITY_ID\")" +
"LEFT JOIN \"ANALYSIS\" ON (\"COMPONENT\".\"ID\" = \"ANALYSIS\".\"COMPONENT_ID\") AND (\"VULNERABILITY\".\"ID\" = \"ANALYSIS\".\"VULNERABILITY_ID\") AND (\"COMPONENT\".\"PROJECT_ID\" = \"ANALYSIS\".\"PROJECT_ID\") " +
"WHERE \"COMPONENT\".\"PROJECT_ID\" = ?";

private UUID project;
private Map<String, Object> component = new LinkedHashMap<>();
private Map<String, Object> vulnerability = new LinkedHashMap<>();
private Map<String, Object> analysis = new LinkedHashMap<>();
private Map<String, Object> attribution = new LinkedHashMap<>();
// language=SQL
public static final String QUERY = """
SELECT "COMPONENT"."UUID"
, "COMPONENT"."NAME"
, "COMPONENT"."GROUP"
, "COMPONENT"."VERSION"
, "COMPONENT"."PURL"
, "COMPONENT"."CPE"
, "VULNERABILITY"."UUID"
, "VULNERABILITY"."SOURCE"
, "VULNERABILITY"."VULNID"
, "VULNERABILITY"."TITLE"
, "VULNERABILITY"."SUBTITLE"
, "VULNERABILITY"."DESCRIPTION"
, "VULNERABILITY"."RECOMMENDATION"
, "VULNERABILITY"."SEVERITY"
, "VULNERABILITY"."CVSSV2BASESCORE"
, "VULNERABILITY"."CVSSV3BASESCORE"
, "VULNERABILITY"."OWASPRRLIKELIHOODSCORE"
, "VULNERABILITY"."OWASPRRTECHNICALIMPACTSCORE"
, "VULNERABILITY"."OWASPRRBUSINESSIMPACTSCORE"
, "EPSS"."SCORE"
, "EPSS"."PERCENTILE"
, "VULNERABILITY"."CWES"
, "FINDINGATTRIBUTION"."ANALYZERIDENTITY"
, "FINDINGATTRIBUTION"."ATTRIBUTED_ON"
, "FINDINGATTRIBUTION"."ALT_ID"
, "FINDINGATTRIBUTION"."REFERENCE_URL"
, "ANALYSIS"."STATE"
, "ANALYSIS"."SUPPRESSED"
FROM "COMPONENT"
INNER JOIN "COMPONENTS_VULNERABILITIES"
ON "COMPONENT"."ID" = "COMPONENTS_VULNERABILITIES"."COMPONENT_ID"
INNER JOIN "VULNERABILITY"
ON "COMPONENTS_VULNERABILITIES"."VULNERABILITY_ID" = "VULNERABILITY"."ID"
LEFT JOIN "EPSS"
ON "VULNERABILITY"."VULNID" = "EPSS"."CVE"
INNER JOIN "FINDINGATTRIBUTION"
ON "COMPONENT"."ID" = "FINDINGATTRIBUTION"."COMPONENT_ID"
AND "VULNERABILITY"."ID" = "FINDINGATTRIBUTION"."VULNERABILITY_ID"
LEFT JOIN "ANALYSIS"
ON "COMPONENT"."ID" = "ANALYSIS"."COMPONENT_ID"
AND "VULNERABILITY"."ID" = "ANALYSIS"."VULNERABILITY_ID"
AND "COMPONENT"."PROJECT_ID" = "ANALYSIS"."PROJECT_ID"
WHERE "COMPONENT"."PROJECT_ID" = ?
""";

private final UUID project;
private final Map<String, Object> component = new LinkedHashMap<>();
private final Map<String, Object> vulnerability = new LinkedHashMap<>();
private final Map<String, Object> analysis = new LinkedHashMap<>();
private final Map<String, Object> attribution = new LinkedHashMap<>();

/**
* Constructs a new Finding object. The generic Object array passed as an argument is the
Expand Down Expand Up @@ -146,19 +156,19 @@ public Finding(UUID project, Object... o) {
optValue(analysis, "isSuppressed", o[27], false);
}

public Map getComponent() {
public Map<String, Object> getComponent() {
return component;
}

public Map getVulnerability() {
public Map<String, Object> getVulnerability() {
return vulnerability;
}

public Map getAnalysis() {
public Map<String, Object> getAnalysis() {
return analysis;
}

public Map getAttribution() {
public Map<String, Object> getAttribution() {
return attribution;
}

Expand Down
3 changes: 1 addition & 2 deletions src/main/java/org/dependencytrack/persistence/FindingsQueryManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@

import alpine.resources.AlpineRequest;
import com.github.packageurl.PackageURL;
import org.datanucleus.api.jdo.JDOQuery;
import org.dependencytrack.model.Analysis;
import org.dependencytrack.model.AnalysisComment;
import org.dependencytrack.model.AnalysisJustification;
Expand Down Expand Up @@ -338,7 +337,7 @@ public List<Finding> getFindings(Project project) {
*/
@SuppressWarnings("unchecked")
public List<Finding> getFindings(Project project, boolean includeSuppressed) {
final Query<Object[]> query = pm.newQuery(JDOQuery.SQL_QUERY_LANGUAGE, Finding.QUERY);
final Query<Object[]> query = pm.newQuery(Query.SQL, Finding.QUERY);
query.setParameters(project.getId());
final List<Object[]> list = query.executeList();
final List<Finding> findings = new ArrayList<>();
Expand Down
12 changes: 6 additions & 6 deletions src/test/java/org/dependencytrack/model/FindingTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,16 +31,16 @@

public class FindingTest extends PersistenceCapableTest {

private UUID projectUuid = UUID.randomUUID();
private Date attributedOn = new Date();
private Finding finding = new Finding(projectUuid, "component-uuid", "component-name", "component-group",
private final UUID projectUuid = UUID.randomUUID();
private final Date attributedOn = new Date();
private final Finding finding = new Finding(projectUuid, "component-uuid", "component-name", "component-group",
"component-version", "component-purl", "component-cpe", "vuln-uuid", "vuln-source", "vuln-vulnId", "vuln-title",
"vuln-subtitle", "vuln-description", "vuln-recommendation", Severity.HIGH, BigDecimal.valueOf(7.2), BigDecimal.valueOf(8.4), BigDecimal.valueOf(1.25), BigDecimal.valueOf(1.75), BigDecimal.valueOf(1.3),
BigDecimal.valueOf(0.5), BigDecimal.valueOf(0.9), null, AnalyzerIdentity.INTERNAL_ANALYZER, attributedOn, null, null, AnalysisState.NOT_AFFECTED, true);

@Test
public void testComponent() {
Map map = finding.getComponent();
Map<String, Object> map = finding.getComponent();
Assert.assertEquals("component-uuid", map.get("uuid"));
Assert.assertEquals("component-name", map.get("name"));
Assert.assertEquals("component-group", map.get("group"));
Expand All @@ -50,7 +50,7 @@ public void testComponent() {

@Test
public void testVulnerability() {
Map map = finding.getVulnerability();
Map<String, Object> map = finding.getVulnerability();
Assert.assertEquals("vuln-uuid", map.get("uuid"));
Assert.assertEquals("vuln-source", map.get("source"));
Assert.assertEquals("vuln-vulnId", map.get("vulnId"));
Expand All @@ -71,7 +71,7 @@ public void testVulnerability() {

@Test
public void testAnalysis() {
Map map = finding.getAnalysis();
Map<String, Object> map = finding.getAnalysis();
Assert.assertEquals(AnalysisState.NOT_AFFECTED, map.get("state"));
Assert.assertEquals(true, map.get("isSuppressed"));
}
Expand Down