-
Notifications
You must be signed in to change notification settings - Fork 5
/
sonarqube.py
executable file
·96 lines (79 loc) · 2.57 KB
/
sonarqube.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
#!/usr/bin/env python3
import json
import os
import sys
LOG_PREFIX = "[trivy][plugins][sonarqube]"
TRIVY_SONARQUBE_SEVERITY = {
"UNKNOWN": "LOW",
"LOW": "LOW",
"MEDIUM": "LOW",
"HIGH": "MEDIUM",
"CRITICAL": "HIGH",
}
def load_trivy_report(fname):
with open(fname) as fobj:
return json.loads(fobj.read())
def parse_trivy_report(report):
for result in report.get("Results", []):
for vuln in result.get("Vulnerabilities", []):
try:
vuln["Target"] = result["Target"]
for key in (
"VulnerabilityID",
"Title",
"Description",
"Severity",
"PrimaryURL",
):
vuln[key]
except KeyError:
continue
yield vuln
def make_sonar_issues(vulnerabilities, file_path=None):
seen_rules = set()
res = {"rules": [], "issues": []}
for vuln in vulnerabilities:
if vuln["VulnerabilityID"] not in seen_rules:
res["rules"].append(
{
"id": vuln["VulnerabilityID"],
"name": vuln["Title"],
"description": vuln["Description"],
"engineId": "Trivy",
"cleanCodeAttribute": "LOGICAL",
"impacts": [
{
"softwareQuality": "SECURITY",
"severity": TRIVY_SONARQUBE_SEVERITY[vuln["Severity"]],
}
],
}
)
seen_rules.add(vuln["VulnerabilityID"])
res["issues"].append(
{
"ruleId": vuln["VulnerabilityID"],
"primaryLocation": {
"message": f"{vuln['Description']} Details: {vuln['PrimaryURL']}",
"filePath": file_path or vuln["Target"],
},
}
)
return res
def make_sonar_report(res):
return json.dumps(res, indent=2)
def main(args):
fname = args[1]
if not os.path.exists(fname):
sys.exit(f"{LOG_PREFIX} file not found: {fname}")
arg_filePath = None
for arg in args[2:]:
if "filePath" in arg:
arg_filePath = arg.split("=")[-1].strip()
report = load_trivy_report(fname)
vulnerabilities = parse_trivy_report(report)
res = make_sonar_issues(vulnerabilities, file_path=arg_filePath)
report = make_sonar_report(res)
print(report)
if __name__ == "__main__":
main(sys.argv)