Version: 2608.1

issue folder

Description

A folder that collects information about the issues detected during the analysis. The folder contains multiple JSON files holding the issue information. Note that the issue information provided differs depending on the analysis.

Source code analysis: the name of the issue detection rule, the file, the line, and so on
Open source analysis: the name of the issue detection rule, the name of the open source component, license information, and so on
Web vulnerability analysis: the name of the issue detection rule, the analyzed URL, request information including parameters, and so on

File

Source code analysis issue

{
  "issueId" : null,
  "toolType" : "SAST",
  "checkerKey" : "SAST.SW.CCPP.33",
  "determinant" : "75c41dfe0f3d05ef10e835e37427d51e39aa4eb6",
  "risk" : 4,
  "method" : "bug",
  "lineNumber" : 19,
  "filePaths" : [ "FILE_PATH" ],
  "startContextIdx" : 0,
  "fileIdx" : 0,
  "contexts" : [ {
    "eventMsgs" : [ {
      "type" : "source",
      "fileIdx" : 0,
      "line" : 18,
      "messages" : [ {
        "message" : "horus.COMMON.var_0_decl",
        "args" : [ "'a'" ]
      } ],
      "prevLink" : null,
      "link" : null
    }, {
      "type" : "sink",
      "fileIdx" : 0,
      "line" : 19,
      "messages" : [ {
        "message" : "horus.OVERRUN.STATIC.default_desc_0",
        "args" : [ "'a'" ]
      }, {
        "message" : "horus.COMMON.size_0_index_1",
        "args" : [ "10", "10" ]
      } ],
      "prevLink" : null,
      "link" : null
    } ]
  } ],
  "extra" : null,
  "issueSimilarityGroupId" : null,
  "tags" : null,
  "hashes" : [ "35947faea8a2b85e3e8cde7139b8d47a05919e88" ],
  "zipFileObjectPaths" : [ "/null" ]
}

issueId Issue ID
toolType Analysis type The type of the requested analysis (TYPE). It takes one of the following values.
- SAST: source code analysis
- SCA: open source analysis
- DAST: web vulnerability analysis
checkerKey Issue detection rule key The key of the rule that detected the issue.
risk Risk level The risk level of the detected issue, classified into five levels: Very high, High, Medium, Low, and Very low, each shown as a number.
- 5: an issue with a Very high risk level
- 4: an issue with a High risk level
- 3: an issue with a Medium risk level
- 2: an issue with a Low risk level
- 1: an issue with a Very low risk level
lineNumber Issue detection point Shows the point in the file where the issue occurred, as a source code line number.
filePaths File paths The paths of the files in which the issue was detected.
fileIdx File index The sequence number of the file in which the issue was detected. If the issue occurred across multiple files, you can check the sequence number of the file.
eventMsgs Issue detection information
- type Type of the issue detection information
  - Sink: the decisive point in the source code where the issue occurs.
  - Source: the entry point or cause where the issue originates.
  - Branch: the executable code that contributes to the issue occurring.
  - Framework: the structure through which the issue propagates from its cause to the point where it occurs.
- fileIdx
- line Source code line
issueSimilarityGroupId Similar issue group ID
tags Tags
hashes Hashes

Open source analysis issue

{
  "versionId" : "__virt_50cabe6ff1c600835ca832884c723b5c1481070318a64b1cf8adf1804796a5c8",
  "matchType" : "DEPENDENCY",
  "originalVersion" : null,
  "targets" : [ {
    "targetType" : "FILE",
    "name" : "pom.xml",
    "relativePath" : "spdxFullLicense.zip/pom.xml",
    "hashes" : [ {
      "algorithm" : "sha1",
      "value" : "4a62e0f669425ffb8afdae1ec82fc01ed2da6f31"
    } ],
    "type" : null,
    "extra" : [ "zip/etc" ]
  } ],
  "name" : "com.sparrow.sca:application_OpenSSL-standalone",
  "version" : "1.0",
  "purl" : "pkg:maven/com.sparrow.sca/application_OpenSSL-standalone@1.0",
  "repository" : "Maven",
  "repositoryUri" : "https://central.sonatype.com/artifact/com.sparrow.sca/application_OpenSSL-standalone/1.0",
  "binaryHashes" : [ ],
  "sourceTotalHashes" : [ ],
  "confidenceScore" : 7.857142857142857,
  "publishedDate" : null,
  "licenses" : [ ],
  "issues" : [ ],
  "copyrights" : [ ],
  "ecosystem" : {
    "osInfo" : null,
    "packageManager" : null,
    "repository" : "Maven"
  },
  "supplier" : {
    "name" : null,
    "email" : null
  }
}

versionId Version ID
matchType Identification type The type of target used to identify the component. It takes one of the following values.
- Binary: when the analyzed target is a binary file
- Dependency: when the analyzed target is a dependency file
- Source code: when source code was the analysis target and hash values of the source code were generated and compared
- Snippet: when the component was detected in a header file (.h or .hpp) among C/C++ language files
- SBOM: when an SBOM file listing the components that make up the software was analyzed
targets Analysis targets
- targetType Analysis target type
- name Analysis target name
- relativePath Relative path of the analysis target
- hashes Hashes of the analysis target
  - algorithm Hash algorithm
  - value Hash value
- name Component name
- version Component version
- purl PURL of the component
- repository Component repository
- repositoryUri URI of the component repository
- binaryHashes Hashes, when the identification type is binary
- sourceTotalHashes Hashes, when the identification type is source code
- confidenceScore Confidence score
- publishedDate Component release date
- licenses Open source licenses
- issues Known vulnerabilities
- copyrights Copyright information
- ecosystem Ecosystem
  -osInfo OS information
  -packageManager Package manager
  -repository Repository
- supplier Supplier
  - name Supplier name
  - email Supplier email

Web vulnerability analysis issue

 {
  "toolType" : "DAST",
  "checkerKey" : "RULE_KEY",
  "determinant" : "5157498448cb712a1a8cc39691d204301cc9e59e8824b1fdb558eec5020110bd",
  "risk" : 3,
  "url" : "http://u306.dev.iplanbiz.co.kr:8401/home/layout/list",
  "method" : "GET",
  "parameter" : null,
  "engineId" : "DAST_EV1_ANALYZER",
  "attack" : [ {
    "step" : 0,
    "fragment" : [ {
      "order" : 0,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.attack.s0.o0",
      "args" : [ ]
    }, {
      "order" : 1,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.attack.s0.o1",
      "args" : [ ]
    } ]
  }, {
    "step" : 1,
    "fragment" : [ {
      "order" : 0,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.attack.s1.o0",
      "args" : [ {
        "order" : 0,
        "type" : "code",
        "value" : "GET http://u306.dev.iplanbiz.co.kr:8401/home/layout/list HTTP/1.1\r\nAccept-Language: en-US\r\nCookie: toolType=PC;iportal_JSESSIONID_306=F642219118936C1A91057AD26DA5467D\r\n"
      } ]
    }, {
      "order" : 1,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.attack.s1.o1",
      "args" : [ {
        "order" : 0,
        "type" : "code",
        "value" : "Empty String"
      } ]
    } ]
  } ],
  "result" : [ {
    "step" : 0,
    "fragment" : [ {
      "order" : 0,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.result.s0.o0",
      "args" : [ ]
    } ]
  } ],
  "solution" : [ {
    "step" : 0,
    "fragment" : [ {
      "order" : 0,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.solution.s0.o0",
      "args" : [ ]
    }, {
      "order" : 1,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.solution.s0.o1",
      "args" : [ ]
    }, {
      "order" : 2,
      "type" : "msg",
      "value" : "2.http.cookie_attribute_test_same_site.not_exist.solution.s0.o2",
      "args" : [ ]
    } ]
  } ],
  "events" : "{\"version\":\"1.1\",\"seedUrl\":\"http://u306.dev.iplanbiz.co.kr:8401/home/layout/list\",\"dastEventList\":[{\"type\":\"http\",\"data\":{\"method\":\"GET\",\"url\":\"http://u306.dev.iplanbiz.co.kr:8401/home/layout/list\",\"headers\":[{\"name\":\"Accept-Language\",\"value\":\"en-US\"},{\"name\":\"Cookie\",\"value\":\"toolType=PC;iportal_JSESSIONID_306=F642219118936C1A91057AD26DA5467D\"}],\"body\":\"\"}}]}",
  "records" : null,
  "recheck" : "{\"@class\":\"com.sparrow.dast.engine.ev1.analysis.recheck.HbRecheck\",\"type\":{\"@type\":\"string\",\"@value\":\"http\"},\"checkerId\":{\"@type\":\"string\",\"@value\":\"DAST.SW.COMMON.5837\"},\"target\":{\"@type\":\"jsonType\",\"@jsonType\":\"com.sparrow.dast.engine.ev1.analysis.targets.HbTarget\",\"@value\":{\"@class\":\"com.sparrow.dast.engine.ev1.analysis.targets.HbTarget\",\"request\":{\"reqHeader\":\"GET http://u306.dev.iplanbiz.co.kr:8401/home/layout/list HTTP/1.1\\r\\nAccept-Language: en-US\\r\\nCookie: toolType=PC;iportal_JSESSIONID_306=F642219118936C1A91057AD26DA5467D\\r\\n\",\"reqBody\":\"\"}}}}",
  "doms" : [ ]
}

toolType Analysis type The type of the requested analysis (TYPE). It takes one of the following values.
- SAST: source code analysis
- SCA: open source analysis
- DAST: web vulnerability analysis
checkerKey Issue detection rule key The key of the rule that detected the issue.
risk Risk level The risk level of the detected issue, classified into five levels: Very high, High, Medium, Low, and Very low, each shown as a number.
- 5: an issue with a Very high risk level
- 4: an issue with a High risk level
- 3: an issue with a Medium risk level
- 2: an issue with a Low risk level
- 1: an issue with a Very low risk level
url URL where the issue was detected
method Request method
parameter Request parameter
attack Attack method
result Analysis result

Description

File

Source code analysis issue​

Open source analysis issue​

Web vulnerability analysis issue​

Source code analysis issue

Open source analysis issue

Web vulnerability analysis issue