Skip to content

Instantly share code, notes, and snippets.

@rfennell
Last active September 30, 2022 11:46
Show Gist options
  • Save rfennell/7a80189659f7fe128f29c71962b11c8e to your computer and use it in GitHub Desktop.
Save rfennell/7a80189659f7fe128f29c71962b11c8e to your computer and use it in GitHub Desktop.
Script to convert OWASP Dependency Check Results to a format that can be ingested into SonarCloud
param
(
# The OWASP results XML file
$input = "dependancy-results.xml",
# The SonarCloud generic issue JSON file
$output = "dependancy-results.json",
# The file to associate issues with
$filename = "c:\folder\file.cs"
)
$doc = New-Object xml
$doc.Load( (Convert-Path $input) )
$list = New-Object System.Collections.ArrayList
$doc.analysis.dependencies.dependency | ForEach-Object {
if ( [bool]($_.PSobject.Properties.name -match "vulnerabilities")) {
$_.vulnerabilities.vulnerability | ForEach-Object {
$jsonItem = @{}
$jsonItem.Add("engineId","DependencyCheck")
$jsonItem.Add("ruleId",$_.name)
$servity = "MAJOR"
if ($_.severity -eq "HIGH") {
$servity = "CRITICAL"
}
$jsonItem.Add("severity",$servity)
$jsonItem.Add("type","VULNERABILITY")
$jsonItemDetail = @{}
$jsonItemDetail.Add("message",$_.description)
$jsonItemDetail.Add("filePath",$filename)
$jsonItem.Add("primaryLocation",$jsonItemDetail)
$list.Add($jsonItem)
}
}
}
$jsonBase = @{}
$jsonBase.Add("issues",$list)
$jsonBase | ConvertTo-Json -Depth 10 | Out-File $output -Encoding utf8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment