Remap CWE 95 to 94

.github/workflows/policyscan-java.yml

@@ -0,0 +1,58 @@
+# Veracode Policy Scan workflow. Requires the following secrets:
+# VERACODE_API_ID - https://help.veracode.com/r/t_create_api_creds
+# VERACODE_API_KEY - https://help.veracode.com/r/t_create_api_creds
+
+name: Veracode Policy Scan
+
+# Controls when the action will run. Triggers the workflow on push or pull request
+# events but only for the master branch
+on:
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build-and-policy-scan:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v5
+      - uses: actions/setup-java@v1 # Make java accessible on path so the uploadandscan action can run.
+        with: 
+          java-version: '11'
+
+      - name: Check for Maven build
+        id: check_maven
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "pom.xml"
+
+      - name: Check for Gradle build
+        id: check_gradle
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "*/build.gradle"
+
+      - name: Build application with mvn
+        if: steps.check_maven.outputs.files_exists == 'true'
+        run: mvn -B package --file pom.xml
+
+      - name: Build application with gradle
+        if: steps.check_gradle.outputs.files_exists == 'true'
+        run: gradle clean build
+
+      - uses: actions/upload-artifact@v4 # Copy files from repository to docker container so the next uploadandscan action can access them.
+        with:
+          path: '**/*.[jw]ar' # Wildcards can be used to filter the files copied into the container. See: https://github.com/actions/upload-artifact
+
+      - uses: veracode/veracode-uploadandscan-action@master # Run the uploadandscan action. Inputs are described above.
+        with:
+          appname: '${{ github.event.repository.name }}'
+          filepath: '**/*.[jw]ar'
+          vid: '${{ secrets.VERACODE_API_ID }}'
+          vkey: '${{ secrets.VERACODE_API_KEY }}'
+          scantimeout: 15
+          createprofile: false

.github/workflows/sca.yml

@@ -0,0 +1,42 @@
+# This workflow will initiate a Veracode SCA Scan. Requires the following secrets:
+# SRCCLR_API_TOKEN - generated when creating a new integration under the Agents tab
+# SCM_GITHUB - https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token
+# USER_EMAIL - email address, used in pull requests
+# USER_NAME - username, used in pull requests
+
+name: Veracode SCA Scan
+
+# Controls when the action will run. Triggers the workflow on push or pull request
+# events but only for the master branch
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+      - main      
+  pull_request:
+    branches:
+      - master
+      - main  
+
+jobs:
+  opensource-scan:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+    - name: SCA Agent scan
+      env: # Set the secret as an input
+        SRCCLR_API_TOKEN: ${{ secrets.SRCCLR_API_TOKEN }}
+        SRCCLR_SCM_TYPE: GITHUB
+        SRCCLR_SCM_TOKEN: ${{ secrets.SCM_GITHUB }} 
+        SRCCLR_PR_ON: methods
+        SRCCLR_NO_BREAKING_UPDATES: true
+        SRCCLR_IGNORE_CLOSED_PRS: true
+        SRCCLR_SCM_URL: https://github.com/$GITHUB_REPOSITORY
+        VERACODE_API_KEY_ID: ${{ secrets.VERACODE_API_ID}}
+        VERACODE_API_KEY_SECRET: ${{ secrets.VERACODE_API_KEY }}
+        EXTRA_ARGS: '--update-advisor --pull-request --unmatched'
+      run: |
+        git config --global user.email "${{ secrets.USER_EMAIL }}"
+        git config --global user.name "${{ secrets.USER_NAME }}"
+        curl -sSL https://download.sourceclear.com/ci.sh | sh -s -- scan --appname=${{ github.event.repository.name }} $EXTRA_ARGS

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/VeracodeReader.java

@@ -17,19 +17,14 @@
  */
 package org.owasp.benchmarkutils.score.parsers;
 
-import java.io.FileInputStream;
 import java.text.SimpleDateFormat;
 import java.util.List;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import org.owasp.benchmarkutils.score.BenchmarkScore;
 import org.owasp.benchmarkutils.score.ResultFile;
 import org.owasp.benchmarkutils.score.TestCaseResult;
 import org.owasp.benchmarkutils.score.TestSuiteResults;
-import org.w3c.dom.Document;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
-import org.xml.sax.InputSource;
 
 public class VeracodeReader extends Reader {
 
@@ -46,7 +41,6 @@ public boolean canRead(ResultFile resultFile) {
     @Override
     public TestSuiteResults parse(ResultFile resultFile) throws Exception {
 
-
         TestSuiteResults tr =
                 new TestSuiteResults("Veracode SAST", true, TestSuiteResults.ToolType.SAST);
 
@@ -135,6 +129,7 @@ private int translate(int cwe) {
         if (cwe == 80) return 79;
         if (cwe == 331) return 330;
         if (cwe == 91) return 643;
+        if (cwe == 95) return 94;
         return cwe;
     }
 }