Add runCognium.sh script for OWASP Benchmark scoring

[coggiyadmin]

Adds a script to scan BenchmarkJava with Cognium and produce a SARIF result file compatible with the BenchmarkUtils Cognium reader.

Install: npm install -g cognium

[davewichers]

@darkspirit510 - Can you use this script to generate a results file and test against the reader he created in BenchmarkUtils and if all good, let me know and I can merge both.

[darkspirit510]

@coggiyadmin first attempt failed with

scripts/runCognium.sh                                                                                                                                         [22:14:00]
✔ Scanned 2766 file(s)
✖ Analysis failed
ENAMETOOLONG: name too long, open 'results/Benchmark_Downloading from central: https://repo.maven.apache.org/maven2/com/internetitem/maven-metadata.xml
Downloading from central: https://repo.maven.apache.org/maven2/com/github/spotbugs/maven-metadata.xml
Downloading from central: https://repo.maven.apache.org/maven2/com/h3xstream/findsecbugs/maven-metadata.xml
Downloading from central: https://repo.maven.apache.org/maven2/org/codehaus/cargo/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/com/github/spotbugs/maven-metadata.xml (240 B at 462 B/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/jasig/mojo/jspc/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/codehaus/cargo/maven-metadata.xml (234 B at 448 B/s)
Downloading from central: https://repo.maven.apache.org/maven2/com/diffplug/spotless/maven-metadata.xml
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/jasig/mojo/jspc/maven-metadata.xml (228 B at 4.8 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-metadata.xml (14 kB at 461 kB/s)
Downloaded from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml (21 kB at 397 kB/s)
Downloaded from central: https://repo.maven.apache.org/maven2/com/internetitem/maven-metadata.xml (408 B at 563 B/s)
1.2-cognium-v1.6.9.sarif'

second attempt worked. Any idea what might be the reason?

[darkspirit510]

Okay, Mac disk was full, maybe this was the reason.

General question: Why do I have to install this as global package? Do you plan to offer this as Docker container?

[coggiyadmin]

@darkspirit510 Unfortunately we dont have docker image, It is in our roadmap, we plan to release them in the future.

[darkspirit510]

@coggiyadmin got similar error on one of my linux servers. Guess this is a bug in cognium.

./scripts/runCognium.sh                                                                                                                       [21:46:53]
✔ Scanned 2766 file(s)
✖ Analysis failed
ENOENT: no such file or directory, open 'results/Benchmark_Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-antrun-plugin/3.2.0/maven-antrun-plugin-3.2.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-antrun-plugin/3.2.0/maven-antrun-plugin-3.2.0.pom (7.7 kB at 20 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-antrun-plugin/3.2.0/maven-antrun-plugin-3.2.0.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-antrun-plugin/3.2.0/maven-antrun-plugin-3.2.0.jar (41 kB at 439 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/3.1.4/maven-deploy-plugin-3.1.4.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/3.1.4/maven-deploy-plugin-3.1.4.pom (9.2 kB at 184 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/3.1.4/maven-deploy-plugin-3.1.4.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-deploy-plugin/3.1.4/maven-deploy-plugin-3.1.4.jar (40 kB at 675 kB/s)

@davewichers since this error is relativ with the scan tool, not the script, this can be merged.

[coggiyadmin]

@davewichers I pushed the changes based on your feedback and please help merge this one

[davewichers]

I merged OWASP-Benchmark/BenchmarkUtils#285. @darkspirit510, can you review this and let me know if you are good with this PR too?

[coggiyadmin]

Hello @davewichers let me know anything I need to do from my side?

[davewichers]

Hello @davewichers let me know anything I need to do from my side?

Sorry, I meant to tag @darkspirit510 in that comment. It was meant for him, not you. I updated the comment to include his tag.