Skip to content

Commit b939c34

Browse files
davewichersdavewichers
committed
Enhance scorecards to now include the tool version most everywhere the tool
name is listed. This will allow people to produce scorecards using multiple versions of the same tool.
1 parent ff612b5 commit b939c34

57 files changed

Lines changed: 460 additions & 273 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎pom.xml‎

Lines changed: 69 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,40 +8,6 @@
88
<name>OWASP Benchmark Project</name>
99
<url>https://www.owasp.org/index.php/Benchmark</url>
1010
<profiles>
11-
<profile>
12-
<id>permute</id>
13-
<properties>
14-
<skipTests>true</skipTests>
15-
</properties>
16-
<build>
17-
<plugins>
18-
<plugin>
19-
<artifactId>maven-clean-plugin</artifactId>
20-
<version>2.6.1</version>
21-
<configuration>
22-
<filesets>
23-
<fileset>
24-
<directory>src/main/java/org/owasp/benchmark/testcode</directory>
25-
<includes>
26-
<include>**/BenchmarkTest*</include>
27-
</includes>
28-
<followSymlinks>false</followSymlinks>
29-
</fileset>
30-
<fileset>
31-
<directory>src/main/webapp</directory>
32-
<includes>
33-
<include>**/BenchmarkTest*</include>
34-
<include>**/*Index*</include>
35-
</includes>
36-
<followSymlinks>false</followSymlinks>
37-
</fileset>
38-
</filesets>
39-
</configuration>
40-
</plugin>
41-
</plugins>
42-
</build>
43-
</profile>
44-
4511
<profile>
4612
<id>crawler</id>
4713
<build>
@@ -174,7 +140,7 @@
174140
<configuration>
175141
<files>
176142
<copy>
177-
<file>${basedir}/src/config/server.xml</file>
143+
<file>${basedir}/src/config/local/server.xml</file>
178144
<tofile>conf/server.xml</tofile>
179145
<configfile>true</configfile>
180146
<overwrite>true</overwrite>
@@ -197,6 +163,74 @@
197163
</build>
198164
</profile>
199165

166+
<profile>
167+
<id>deploywremote</id>
168+
<properties>
169+
<skipTests>true</skipTests>
170+
</properties>
171+
<build>
172+
<plugins>
173+
<plugin>
174+
<artifactId>maven-antrun-plugin</artifactId>
175+
<version>1.7</version>
176+
<executions>
177+
<execution>
178+
<id>ldap-server</id>
179+
<phase>package</phase>
180+
<goals>
181+
<goal>run</goal>
182+
</goals>
183+
<configuration>
184+
<target>
185+
<ant target="run" antfile="${basedir}/src/config/build.xml">
186+
<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
187+
</ant>
188+
</target>
189+
</configuration>
190+
</execution>
191+
</executions>
192+
</plugin>
193+
<plugin>
194+
<groupId>org.codehaus.cargo</groupId>
195+
<artifactId>cargo-maven2-plugin</artifactId>
196+
<version>1.4.9</version>
197+
<configuration>
198+
<container>
199+
<timeout>300000</timeout>
200+
<containerId>tomcat8x</containerId>
201+
<zipUrlInstaller>
202+
<url>http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.21/bin/apache-tomcat-8.0.21.zip</url>
203+
</zipUrlInstaller>
204+
</container>
205+
<properties>
206+
<cargo.jvmargs>-XX:MaxPermSize=6G -Xms1G –Xmx8G</cargo.jvmargs>
207+
</properties>
208+
<configuration>
209+
<files>
210+
<copy>
211+
<file>${basedir}/src/config/remote/server.xml</file>
212+
<tofile>conf/server.xml</tofile>
213+
<configfile>true</configfile>
214+
<overwrite>true</overwrite>
215+
</copy>
216+
</files>
217+
<properties>
218+
<cargo.servlet.port>8443</cargo.servlet.port>
219+
<cargo.protocol>https</cargo.protocol>
220+
<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
221+
<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
222+
<cargo.tomcat.connector.keystoreFile>../../../../.keystore</cargo.tomcat.connector.keystoreFile>
223+
<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
224+
<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
225+
<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
226+
</properties>
227+
</configuration>
228+
</configuration>
229+
</plugin>
230+
</plugins>
231+
</build>
232+
</profile>
233+
200234
<profile>
201235
<id>deploywcontrast</id>
202236
<properties>

‎runRemoteAccessibleBenchmark.bat‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
call mvn clean package cargo:run -Pdeploywremote

‎runRemoteAccessibleBenchmark.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/sh
2+
3+
chmod 755 src/main/resources/insecureCmd.sh
4+
mvn clean package cargo:run -Pdeploywremote

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Command_Injection.html‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,11 @@
4141
<li class="dropdown">
4242
<a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Tools<span class="caret"></span></a>
4343
<ul class="dropdown-menu">
44-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs.html">FBwFindSecBugs</a></li>
45-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs.html">FindBugs</a></li>
46-
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP.html">OWASP ZAP</a></li>
47-
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD.html">PMD</a></li>
48-
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin.html">SonarQube Java Plugin</a></li>
44+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs_v1.4.3.html">FBwFindSecBugs v1.4.3</a></li>
45+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs_v3.0.1.html">FindBugs v3.0.1</a></li>
46+
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP_vD-2015-08-24.html">OWASP ZAP vD-2015-08-24</a></li>
47+
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD_v5.2.3.html">PMD v5.2.3</a></li>
48+
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin_v3.5.html">SonarQube Java Plugin v3.5</a></li>
4949
<li><a href="Benchmark_v1.1,1.2beta_Scorecard_for_Commercial_Tools.html">Commercial Average</a></li>
5050

5151
</ul>
@@ -97,11 +97,11 @@ <h3>OWASP Benchmark Scorecard for Command Injection</h3>
9797
<h2>Detailed Results Per Tool for Command Injection</h2>
9898
<table class="table">
9999
<tr><th>Tool</th><th>Benchmark Version</th><th>TP</th><th>FN</th><th>TN</th><th>FP</th><th>Total</th><th>TPR</th><th>FPR</th><th>Score</th></tr>
100-
<tr class="danger"><td>FBwFindSecBugs</td><td>1.2beta</td><td>126</td><td>0</td><td>12</td><td>113</td><td>251</td><td>100.00%</td><td>90.40%</td><td>9.60%</td></tr>
101-
<tr class="danger"><td>FindBugs</td><td>1.2beta</td><td>0</td><td>126</td><td>125</td><td>0</td><td>251</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
102-
<tr ><td>OWASP ZAP</td><td>1.2beta</td><td>44</td><td>82</td><td>125</td><td>0</td><td>251</td><td>34.92%</td><td>0.00%</td><td>34.92%</td></tr>
103-
<tr class="danger"><td>PMD</td><td>1.2beta</td><td>0</td><td>126</td><td>125</td><td>0</td><td>251</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
104-
<tr class="danger"><td>SonarQube Java Plugin</td><td>1.2beta</td><td>107</td><td>19</td><td>16</td><td>109</td><td>251</td><td>84.92%</td><td>87.20%</td><td>-2.28%</td></tr>
100+
<tr class="danger"><td>FBwFindSecBugs v1.4.3</td><td>1.2beta</td><td>126</td><td>0</td><td>12</td><td>113</td><td>251</td><td>100.00%</td><td>90.40%</td><td>9.60%</td></tr>
101+
<tr class="danger"><td>FindBugs v3.0.1</td><td>1.2beta</td><td>0</td><td>126</td><td>125</td><td>0</td><td>251</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
102+
<tr ><td>OWASP ZAP vD-2015-08-24</td><td>1.2beta</td><td>44</td><td>82</td><td>125</td><td>0</td><td>251</td><td>34.92%</td><td>0.00%</td><td>34.92%</td></tr>
103+
<tr class="danger"><td>PMD v5.2.3</td><td>1.2beta</td><td>0</td><td>126</td><td>125</td><td>0</td><td>251</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
104+
<tr class="danger"><td>SonarQube Java Plugin v3.5</td><td>1.2beta</td><td>107</td><td>19</td><td>16</td><td>109</td><td>251</td><td>84.92%</td><td>87.20%</td><td>-2.28%</td></tr>
105105
</tr>
106106
</table>
107107

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Command_Injection.png‎

77.6 KB
Loading

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Commercial_Tools.html‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,11 @@
4141
<li class="dropdown">
4242
<a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Tools<span class="caret"></span></a>
4343
<ul class="dropdown-menu">
44-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs.html">FBwFindSecBugs</a></li>
45-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs.html">FindBugs</a></li>
46-
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP.html">OWASP ZAP</a></li>
47-
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD.html">PMD</a></li>
48-
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin.html">SonarQube Java Plugin</a></li>
44+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs_v1.4.3.html">FBwFindSecBugs v1.4.3</a></li>
45+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs_v3.0.1.html">FindBugs v3.0.1</a></li>
46+
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP_vD-2015-08-24.html">OWASP ZAP vD-2015-08-24</a></li>
47+
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD_v5.2.3.html">PMD v5.2.3</a></li>
48+
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin_v3.5.html">SonarQube Java Plugin v3.5</a></li>
4949
<li><a href="Benchmark_v1.1,1.2beta_Scorecard_for_Commercial_Tools.html">Commercial Average</a></li>
5050

5151
</ul>

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Cross-Site_Scripting.html‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,11 @@
4141
<li class="dropdown">
4242
<a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Tools<span class="caret"></span></a>
4343
<ul class="dropdown-menu">
44-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs.html">FBwFindSecBugs</a></li>
45-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs.html">FindBugs</a></li>
46-
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP.html">OWASP ZAP</a></li>
47-
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD.html">PMD</a></li>
48-
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin.html">SonarQube Java Plugin</a></li>
44+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs_v1.4.3.html">FBwFindSecBugs v1.4.3</a></li>
45+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs_v3.0.1.html">FindBugs v3.0.1</a></li>
46+
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP_vD-2015-08-24.html">OWASP ZAP vD-2015-08-24</a></li>
47+
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD_v5.2.3.html">PMD v5.2.3</a></li>
48+
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin_v3.5.html">SonarQube Java Plugin v3.5</a></li>
4949
<li><a href="Benchmark_v1.1,1.2beta_Scorecard_for_Commercial_Tools.html">Commercial Average</a></li>
5050

5151
</ul>
@@ -97,11 +97,11 @@ <h3>OWASP Benchmark Scorecard for Cross-Site Scripting</h3>
9797
<h2>Detailed Results Per Tool for Cross-Site Scripting</h2>
9898
<table class="table">
9999
<tr><th>Tool</th><th>Benchmark Version</th><th>TP</th><th>FN</th><th>TN</th><th>FP</th><th>Total</th><th>TPR</th><th>FPR</th><th>Score</th></tr>
100-
<tr class="danger"><td>FBwFindSecBugs</td><td>1.2beta</td><td>3</td><td>243</td><td>209</td><td>0</td><td>455</td><td>1.22%</td><td>0.00%</td><td>1.22%</td></tr>
101-
<tr class="danger"><td>FindBugs</td><td>1.2beta</td><td>3</td><td>243</td><td>209</td><td>0</td><td>455</td><td>1.22%</td><td>0.00%</td><td>1.22%</td></tr>
102-
<tr ><td>OWASP ZAP</td><td>1.2beta</td><td>71</td><td>175</td><td>209</td><td>0</td><td>455</td><td>28.86%</td><td>0.00%</td><td>28.86%</td></tr>
103-
<tr class="danger"><td>PMD</td><td>1.2beta</td><td>0</td><td>246</td><td>209</td><td>0</td><td>455</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
104-
<tr class="danger"><td>SonarQube Java Plugin</td><td>1.2beta</td><td>0</td><td>246</td><td>209</td><td>0</td><td>455</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
100+
<tr class="danger"><td>FBwFindSecBugs v1.4.3</td><td>1.2beta</td><td>3</td><td>243</td><td>209</td><td>0</td><td>455</td><td>1.22%</td><td>0.00%</td><td>1.22%</td></tr>
101+
<tr class="danger"><td>FindBugs v3.0.1</td><td>1.2beta</td><td>3</td><td>243</td><td>209</td><td>0</td><td>455</td><td>1.22%</td><td>0.00%</td><td>1.22%</td></tr>
102+
<tr ><td>OWASP ZAP vD-2015-08-24</td><td>1.2beta</td><td>71</td><td>175</td><td>209</td><td>0</td><td>455</td><td>28.86%</td><td>0.00%</td><td>28.86%</td></tr>
103+
<tr class="danger"><td>PMD v5.2.3</td><td>1.2beta</td><td>0</td><td>246</td><td>209</td><td>0</td><td>455</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
104+
<tr class="danger"><td>SonarQube Java Plugin v3.5</td><td>1.2beta</td><td>0</td><td>246</td><td>209</td><td>0</td><td>455</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
105105
</tr>
106106
</table>
107107

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Cross-Site_Scripting.png‎

77.3 KB
Loading

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Insecure_Cookie.html‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,11 @@
4141
<li class="dropdown">
4242
<a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Tools<span class="caret"></span></a>
4343
<ul class="dropdown-menu">
44-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs.html">FBwFindSecBugs</a></li>
45-
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs.html">FindBugs</a></li>
46-
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP.html">OWASP ZAP</a></li>
47-
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD.html">PMD</a></li>
48-
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin.html">SonarQube Java Plugin</a></li>
44+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FBwFindSecBugs_v1.4.3.html">FBwFindSecBugs v1.4.3</a></li>
45+
<li><a href="Benchmark_v1.2beta_Scorecard_for_FindBugs_v3.0.1.html">FindBugs v3.0.1</a></li>
46+
<li><a href="Benchmark_v1.2beta_Scorecard_for_OWASP_ZAP_vD-2015-08-24.html">OWASP ZAP vD-2015-08-24</a></li>
47+
<li><a href="Benchmark_v1.2beta_Scorecard_for_PMD_v5.2.3.html">PMD v5.2.3</a></li>
48+
<li><a href="Benchmark_v1.2beta_Scorecard_for_SonarQube_Java_Plugin_v3.5.html">SonarQube Java Plugin v3.5</a></li>
4949
<li><a href="Benchmark_v1.1,1.2beta_Scorecard_for_Commercial_Tools.html">Commercial Average</a></li>
5050

5151
</ul>
@@ -97,11 +97,11 @@ <h3>OWASP Benchmark Scorecard for Insecure Cookie</h3>
9797
<h2>Detailed Results Per Tool for Insecure Cookie</h2>
9898
<table class="table">
9999
<tr><th>Tool</th><th>Benchmark Version</th><th>TP</th><th>FN</th><th>TN</th><th>FP</th><th>Total</th><th>TPR</th><th>FPR</th><th>Score</th></tr>
100-
<tr class="success"><td>FBwFindSecBugs</td><td>1.2beta</td><td>36</td><td>0</td><td>31</td><td>0</td><td>67</td><td>100.00%</td><td>0.00%</td><td>100.00%</td></tr>
101-
<tr class="danger"><td>FindBugs</td><td>1.2beta</td><td>0</td><td>36</td><td>31</td><td>0</td><td>67</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
102-
<tr class="success"><td>OWASP ZAP</td><td>1.2beta</td><td>36</td><td>0</td><td>31</td><td>0</td><td>67</td><td>100.00%</td><td>0.00%</td><td>100.00%</td></tr>
103-
<tr class="danger"><td>PMD</td><td>1.2beta</td><td>0</td><td>36</td><td>31</td><td>0</td><td>67</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
104-
<tr class="success"><td>SonarQube Java Plugin</td><td>1.2beta</td><td>36</td><td>0</td><td>31</td><td>0</td><td>67</td><td>100.00%</td><td>0.00%</td><td>100.00%</td></tr>
100+
<tr class="success"><td>FBwFindSecBugs v1.4.3</td><td>1.2beta</td><td>36</td><td>0</td><td>31</td><td>0</td><td>67</td><td>100.00%</td><td>0.00%</td><td>100.00%</td></tr>
101+
<tr class="danger"><td>FindBugs v3.0.1</td><td>1.2beta</td><td>0</td><td>36</td><td>31</td><td>0</td><td>67</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
102+
<tr class="success"><td>OWASP ZAP vD-2015-08-24</td><td>1.2beta</td><td>36</td><td>0</td><td>31</td><td>0</td><td>67</td><td>100.00%</td><td>0.00%</td><td>100.00%</td></tr>
103+
<tr class="danger"><td>PMD v5.2.3</td><td>1.2beta</td><td>0</td><td>36</td><td>31</td><td>0</td><td>67</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr>
104+
<tr class="success"><td>SonarQube Java Plugin v3.5</td><td>1.2beta</td><td>36</td><td>0</td><td>31</td><td>0</td><td>67</td><td>100.00%</td><td>0.00%</td><td>100.00%</td></tr>
105105
</tr>
106106
</table>
107107

‎scorecard/Benchmark_v1.1,1.2beta_Scorecard_for_Insecure_Cookie.png‎

78.5 KB
Loading

0 commit comments

Comments
 (0)