dependency-check / dependency-check/DependencyCheck

Add CWE title information in JSON / XML report

Open
#5,769 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**
I recently wanted to switch from CSV report to JSON report to get insights on fix versions and evidence collected, but I noticed that while the CSV report contains the "full" CWE entry consisting of ID and title (using [CweSet.toString()](https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/dependency/CweSet.java#L67)), the JSON report (and also XML report) contains only the CWE ID (obtained via [CweSet.getEntries()](https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/dependency/CweSet.java#L51), see also [/core/src/main/resources/templates/jsonReport.vsl#L244](https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/resources/templates/jsonReport.vsl#L244)).

*Example*:

CVE: "CVE-2021-37533"
reported CWE in CSV: `"CWE-20 Improper Input Validation"`
reported CWE in JSON: `cwes: ["CWE-20"]`

**Describe the solution you'd like**
I would like to have the CWE title in the JSON report in the same way as in the CSV report, i.e. the `.dependencies[].vulnerabilities[].cwes[]` entries should contain a concatenation of CWE ID and title.

*Example from above*:
reported CWE in JSON: `cwes: ["CWE-20 Improper Input Validation"]`

**Describe alternatives you've considered**
If you feel that this change would affect to many existing consumers, I could also envision adding a new property like `fullCwes` which could then contain ID and title as returned by `CweSet.getFullCwes()`.

*Example from above*:
reported CWE in JSON: `cwes: ["CWE-20"], fullCwes: [{"id": "CWE-20", "title": "Improper Input validation"}]`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.