Skip to content

Commit 8d4fcf9

Browse files
davewichersdavewichers
committed
This is a MAJOR change. This commit rips out all the utilities included with Benchmark to score it, run crawlers on it, etc. Those utilities are now in a seperate project called BenchmarkUtils. BenchmarkUtils produces a maven plugin that is now used by all the scoring and crawling scripts updated in this commit. You have to clone BenchmarkUtils, then run: mvn install, to get the plugin (which is built and installed locally).
1 parent aba1a8b commit 8d4fcf9

File tree

129 files changed

+260
-30782
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

129 files changed

+260
-30782
lines changed

‎.gitignore

+5-4
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,15 @@
33
.classpath
44
.project
55
.settings/
6+
.idea/
7+
*.iml
8+
9+
data/out.csv
610
reports/
11+
scripts/SonarQubeCredentials.sh
712
target/
813
testfiles/
914
tools/Contrast/contrast.jar
1015
tools/Contrast/contrast.yaml
1116
tools/Contrast/working/
1217

13-
.idea/
14-
*.iml
15-
16-
scripts/SonarQubeCredentials.sh

‎createAnonScorecards.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1-
mvn validate -Pscorecard -Dexec.args="-cr anonymousScoringConfig.yaml"
1+
source "scripts/verifyBenchmarkPluginAvailable.sh"
2+
mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard -DconfigFile=data/anonymousScoringConfig.yaml
23

‎createScorecards.bat

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1-
call mvn validate -Pscorecard
1+
# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
2+
#mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard -DconfigFile=config/score_v1.3config.yaml
3+
call mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard
24

‎createScorecards.sh

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1-
mvn validate -Pscorecard
1+
source "scripts/verifyBenchmarkPluginAvailable.sh"
2+
#mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard -DconfigFile=config/score_v1.3config.yaml
3+
mvn -Djava.awt.headless=true org.owasp:benchmarkutils-maven-plugin:create-scorecard
24

‎data/anonymousScoringConfig.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# This configuration simply enables anonymous scoring mode
2+
3+
anonymousmode: true # If true, anonymize names of commercial tools
4+

‎data/benchmark-crawler-http.xml

+1-2,741
Large diffs are not rendered by default.

‎pom.xml

-127
Original file line numberDiff line numberDiff line change
@@ -25,63 +25,6 @@
2525
</licenses>
2626

2727
<profiles>
28-
<profile>
29-
<id>crawler</id>
30-
<build>
31-
<plugins>
32-
<plugin>
33-
<groupId>org.codehaus.mojo</groupId>
34-
<artifactId>exec-maven-plugin</artifactId>
35-
<version>${version.exec.maven}</version>
36-
<executions>
37-
<execution>
38-
<phase>validate</phase>
39-
<goals>
40-
<goal>java</goal>
41-
</goals>
42-
<configuration>
43-
<mainClass>org.owasp.benchmark.tools.BenchmarkCrawler</mainClass>
44-
<arguments>
45-
<argument>${addlArg1}</argument> <!-- -f here -->
46-
<argument>${addlArg2}</argument> <!-- filename here -->
47-
</arguments>
48-
</configuration>
49-
</execution>
50-
</executions>
51-
</plugin>
52-
</plugins>
53-
</build>
54-
</profile>
55-
56-
<profile>
57-
<id>scorecard</id>
58-
<build>
59-
<plugins>
60-
<plugin>
61-
<groupId>org.codehaus.mojo</groupId>
62-
<artifactId>exec-maven-plugin</artifactId>
63-
<version>${version.exec.maven}</version>
64-
<executions>
65-
<execution>
66-
<phase>validate</phase>
67-
<goals>
68-
<goal>java</goal>
69-
</goals>
70-
<configuration>
71-
<mainClass>org.owasp.benchmark.score.BenchmarkScore</mainClass>
72-
<systemProperties>
73-
<systemProperty>
74-
<key>java.awt.headless</key>
75-
<value>true</value>
76-
</systemProperty>
77-
</systemProperties>
78-
</configuration>
79-
</execution>
80-
</executions>
81-
</plugin>
82-
</plugins>
83-
</build>
84-
</profile>
8528

8629
<profile>
8730
<id>findsecbugs</id>
@@ -655,30 +598,6 @@
655598
</build>
656599
</profile>
657600

658-
<profile>
659-
<id>time</id>
660-
<build>
661-
<plugins>
662-
<plugin>
663-
<groupId>org.codehaus.mojo</groupId>
664-
<artifactId>exec-maven-plugin</artifactId>
665-
<version>${version.exec.maven}</version>
666-
<executions>
667-
<execution>
668-
<phase>validate</phase>
669-
<goals>
670-
<goal>java</goal>
671-
</goals>
672-
<configuration>
673-
<mainClass>org.owasp.benchmark.score.WriteTime</mainClass>
674-
</configuration>
675-
</execution>
676-
</executions>
677-
</plugin>
678-
</plugins>
679-
</build>
680-
</profile>
681-
682601
</profiles>
683602

684603
<dependencies>
@@ -709,13 +628,6 @@
709628
<version>1.4</version>
710629
</dependency>
711630

712-
<dependency>
713-
<groupId>commons-io</groupId>
714-
<artifactId>commons-io</artifactId>
715-
<!-- latest is: <version>2.7</version>, but 2.7+ requires Java 8 -->
716-
<version>2.6</version>
717-
</dependency>
718-
719631
<dependency>
720632
<groupId>commons-lang</groupId>
721633
<artifactId>commons-lang</artifactId>
@@ -730,20 +642,6 @@
730642
<version>1.7.32</version>
731643
</dependency>
732644

733-
<dependency>
734-
<groupId>org.apache.commons</groupId>
735-
<artifactId>commons-csv</artifactId>
736-
<!-- Latest is: <version>1.8</version>, but 1.7+ requires Java 8 -->
737-
<version>1.6</version>
738-
</dependency>
739-
740-
<dependency>
741-
<groupId>org.apache.commons</groupId>
742-
<artifactId>commons-lang3</artifactId>
743-
<!-- <version>3.10</version> is latest, but 3.9+ requires Java 8 -->
744-
<version>3.8.1</version>
745-
</dependency>
746-
747645
<dependency>
748646
<groupId>org.apache.directory.server</groupId>
749647
<artifactId>apacheds-core</artifactId>
@@ -902,25 +800,6 @@
902800
<version>2.3.6</version>
903801
</dependency>
904802

905-
<dependency>
906-
<groupId>org.jfree</groupId>
907-
<artifactId>jcommon</artifactId>
908-
<version>1.0.24</version>
909-
</dependency>
910-
911-
<dependency>
912-
<groupId>org.jfree</groupId>
913-
<artifactId>jfreechart</artifactId>
914-
<!-- <version>1.5.1</version> This is latest version, but requires Java 8. 1.5.0 is last version to support Java 7. -->
915-
<version>1.5.0</version>
916-
</dependency>
917-
918-
<dependency>
919-
<groupId>org.json</groupId>
920-
<artifactId>json</artifactId>
921-
<version>20201115</version>
922-
</dependency>
923-
924803
<dependency>
925804
<groupId>org.owasp.esapi</groupId>
926805
<artifactId>esapi</artifactId>
@@ -958,12 +837,6 @@
958837
<version>${version.springframework}</version>
959838
</dependency>
960839

961-
<dependency>
962-
<groupId>org.yaml</groupId>
963-
<artifactId>snakeyaml</artifactId>
964-
<version>1.29</version>
965-
</dependency>
966-
967840
<dependency>
968841
<groupId>xml-apis</groupId>
969842
<artifactId>xml-apis</artifactId>

‎runCrawler.bat

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1-
CALL mvn validate -Pcrawler
1+
# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
2+
CALL mvn org.owasp:benchmarkutils-maven-plugin:run-crawler -DcrawlerFile=data/benchmark-crawler-http.xml
23

‎runCrawler.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
#!/bin/sh
2-
mvn validate -Pcrawler
1+
source "scripts/verifyBenchmarkPluginAvailable.sh"
2+
mvn org.owasp:benchmarkutils-maven-plugin:run-crawler -DcrawlerFile=data/benchmark-crawler-http.xml
33

‎scripts/runCodeQL.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# This script assumes the owasp-benchmark database has already been initialized by running this first:
2+
# ../../Tools/codeql-home/codeql/codeql database create owasp-benchmark --language=java
3+
../../Tools/codeql-home/codeql/codeql database analyze owasp-benchmark java-code-scanning.qls --format=sarifv2.1.0 --output=results/Benchmark_1.2-codeql_java-code-scanning_qls.sarif
4+

‎scripts/runCodeQLFull.sh

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# The full list of java CodeQL query sets is:
2+
# tested: java-code-scanning.qls - Standard Code Scanning queries for Java - This does NOT include Weak Random rule.
3+
# tested: java-security-extended.qls - Security-extended queries for Java - Same score.
4+
## this one builds on the previous one a litte
5+
# tested: java-security-and-quality.qls - Security-and-quality queries for Java - This ONE adds Weak Random rule.
6+
## this one builds on the previous one. But detects nothing additional - Also does NOT include Weak Random rule.
7+
# tested: java-lgtm.qls - Standard LGTM queries for Java - scores lower than lgtm-full by 1 category (Random)
8+
# tested: java-lgtm-full.qls - Standard LGTM queries for Java, including ones not displayed by default - This ONE adds Weak Random rule.
9+
10+
# This script assumes the owasp-benchmark database has already been initialized by running this first:
11+
# ../../Tools/codeql-home/codeql/codeql database create owasp-benchmark --language=java
12+
#../../Tools/codeql-home/codeql/codeql database analyze owasp-benchmark java-security-extended.qls --format=sarifv2.1.0 --output=results/Benchmark_1.2-codeql_java-security-extended.sarif
13+
../../Tools/codeql-home/codeql/codeql database analyze owasp-benchmark java-security-and-quality.qls --format=sarifv2.1.0 --output=results/Benchmark_1.2-codeql_java-security-and-quality.sarif
14+

‎scripts/runFindBugs.bat

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
12
# FindBugs is dead, so this specifies the specific (last) version of findbugs. Its version is not defined in the pom.xml file.
2-
call mvn compile org.codehaus.mojo:findbugs-maven-plugin:3.0.5:findbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes/out.csv
3-
call mvn validate -Ptime -Dexec.args="findbugs"
3+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
4+
CALL mvn compile org.codehaus.mojo:findbugs-maven-plugin:3.0.5:findbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
5+
CALL mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=findbugs
6+

‎scripts/runFindBugs.sh

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
# FindBugs is dead, so this specifies the specific (last) version of findbugs. Its version is not defined in the pom.xml file.
2-
mvn compile org.codehaus.mojo:findbugs-maven-plugin:3.0.5:findbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes/out.csv
3-
mvn validate -Ptime -Dexec.args="findbugs"
2+
source "scripts/verifyBenchmarkPluginAvailable.sh"
3+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
4+
mvn compile org.codehaus.mojo:findbugs-maven-plugin:3.0.5:findbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
5+
mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=findbugs
6+

‎scripts/runFindSecBugs.bat

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
1-
call mvn compile -Pfindsecbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes\out.csv
2-
call mvn validate -Ptime -Dexec.args="findsecbugs"
1+
# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
2+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
3+
CALL mvn compile -Pfindsecbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
4+
CALL mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=findsecbugs
5+

‎scripts/runFindSecBugs.sh

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
1-
mvn compile -Pfindsecbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes/out.csv
2-
mvn validate -Ptime -Dexec.args="findsecbugs"
1+
source "scripts/verifyBenchmarkPluginAvailable.sh"
2+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
3+
mvn compile -Pfindsecbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
4+
mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=findsecbugs
5+

‎scripts/runPMD.bat

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
1-
call mvn compile pmd:pmd -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes\out.csv
2-
call mvn validate -Ptime -Dexec.args="pmd"
1+
# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
2+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
3+
CALL mvn compile pmd:pmd -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
4+
CALL mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=pmd
5+

‎scripts/runPMD.sh

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
1-
mvn compile pmd:pmd -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes/out.csv
2-
mvn validate -Ptime -Dexec.args="pmd"
1+
source "scripts/verifyBenchmarkPluginAvailable.sh"
2+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
3+
mvn compile pmd:pmd -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
4+
mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=pmd
5+

‎scripts/runSpotBugs.bat

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
1-
call mvn compile spotbugs:spotbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes\out.csv
2-
call mvn validate -Ptime -Dexec.args="spotbugs"
1+
# source "scripts/verifyBenchmarkPluginAvailable.sh" - Don't have .bat version of this (yet)
2+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
3+
CALL mvn compile spotbugs:spotbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
4+
CALL mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=spotbugs
5+

‎scripts/runSpotBugs.sh

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
1-
mvn compile spotbugs:spotbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=classes/out.csv
2-
mvn validate -Ptime -Dexec.args="spotbugs"
1+
source "scripts/verifyBenchmarkPluginAvailable.sh"
2+
# The buildtime elements when invoking the findbugs-maven-plugin leverage the buildtime extension specified in: .mvn/extensions.xml
3+
mvn compile spotbugs:spotbugs -Dbuildtime.output.csv=true -Dbuildtime.output.csv.file=../data/out.csv
4+
mvn org.owasp:benchmarkutils-maven-plugin:append-time -DtoolName=spotbugs
5+

‎scripts/translateCodeQL.sh

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#a This translates the current app, and builds up the rules databases. This only has to be run once after each code change.
2+
../../Tools/codeql-home/codeql/codeql database create owasp-benchmark --language=java --overwrite
3+

‎scripts/verifyBenchmarkPluginAvailable.sh

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Verify the benchmarkutils plugin is installed. And if not, explain how to install it
2+
mvn -Djava.awt.headless=true -Dplugin=org.owasp:benchmarkutils-maven-plugin help:describe 2>&1 >/dev/null
3+
4+
if [ $? -ne 0 ]
5+
then
6+
echo ""
7+
echo "!!!WARNING: Required plugin: org.owasp:benchmarkutils-maven-plugin not available."
8+
echo "To get and install it, do the following:"
9+
echo " git clone https://github.com/OWASP-Benchmark/BenchmarkUtils.git"
10+
echo " cd BenchmarkUtils"
11+
echo " mvn install"
12+
echo ""
13+
echo "This installs the plugin in your local Maven repo, and it can then be used from anywhere."
14+
echo ""
15+
exit -1
16+
fi
17+

0 commit comments

Comments
 (0)