dependency-check / dependency-check/DependencyCheck
Add CWE title information in JSON / XML report
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
I recently wanted to switch from CSV report to JSON report to get insights on fix versions and evidence collected, but I noticed that while the CSV report contains the "full" CWE entry consisting of ID and title (using [CweSet.toString()](https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/dependency/CweSet.java#L67)), the JSON report (and also XML report) contains only the CWE ID (obtained via [CweSet.getEntries()](https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/dependency/CweSet.java#L51), see also [/core/src/main/resources/templates/jsonReport.vsl#L244](https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/resources/templates/jsonReport.vsl#L244)).
*Example*:
CVE: "CVE-2021-37533"
reported CWE in CSV: `"CWE-20 Improper Input Validation"`
reported CWE in JSON: `cwes: ["CWE-20"]`
**Describe the solution you'd like**
I would like to have the CWE title in the JSON report in the same way as in the CSV report, i.e. the `.dependencies[].vulnerabilities[].cwes[]` entries should contain a concatenation of CWE ID and title.
*Example from above*:
reported CWE in JSON: `cwes: ["CWE-20 Improper Input Validation"]`
**Describe alternatives you've considered**
If you feel that this change would affect to many existing consumers, I could also envision adding a new property like `fullCwes` which could then contain ID and title as returned by `CweSet.getFullCwes()`.
*Example from above*:
reported CWE in JSON: `cwes: ["CWE-20"], fullCwes: [{"id": "CWE-20", "title": "Improper Input validation"}]`
Contributor guide
Assessment
This issue has not been assessed yet.