dependency-check / dependency-check/DependencyCheck
Add CVE number to name attribute in JUnit output so that it will be displayed on Azure Pipeline Runs results
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
Azure Pipeline supports publishing the DependencyCheck report generated by maven in Junit format to its Test Runs report page.
The CVE number which is arguably the most important piece of information in the generated report is missing from being displayed on the Azure DevOps Runs Report page. Instead, the attribute "name" under the tag testcase is displayed, .e.g., pkg:maven/org.yaml/snakeyaml@1.30
**Describe the solution you'd like**
Add the CVE number to the attribute "name" so that it will be displayed on Azure DevOps Runs Report page, e.g.,
Current:
<testcase classname="CVE-2022-25857" name="pkg:maven/org.yaml/snakeyaml@1.30">
Proposed:
<testcase classname="CVE-2022-25857" name="**CVE-2022-25857** pkg:maven/org.yaml/snakeyaml@1.30">
**Describe alternatives you've considered**
Any other means so that the CVE number is displayed on the Azure DevOps Runs page are appreciated.
**Additional context**
Exhibit 1 - Azure DevOps screen : On the Runs > Test results page, no CVE number is displayed:

Exhibit 2 - Azure DevOps screen : Drill down the failed test case, no CVE number is displayed. The title seems like to be extracted from the "name" attribute only.

Exhibit 3 - The sample junit report xml file showing the proposed attribute change, i.e., prepend CVE number to the "name" attribute of the testcase tag.

Contributor guide
Assessment
This issue has not been assessed yet.