Repository: globocom/huskyCI
Pull request #430 (2019-11-26 14:32:46)

Fix SonarQube empty slice output
This PR aims to fix the case where there is no vulnerability present in a given project.

The output used to be: `{"issues":null}` and looks like this causes an error when we try to import it to SonarQube as it expects an empty array.

Now the output looks like: `{"issues":[]}`. Added a test case to ensure that the output is generated correctly.


Patch:
diff --git a/client/integration/sonarqube/sonarqube.go b/client/integration/sonarqube/sonarqube.go
index 1480cec..65e7f19 100644
--- a/client/integration/sonarqube/sonarqube.go
+++ b/client/integration/sonarqube/sonarqube.go
@@ -25,7 +25,7 @@ or is not associated with any specific file, i.e.: vulnerable dependency version
 // GenerateOutputFile prints the analysis output in a JSON format
 func GenerateOutputFile(analysis types.Analysis, outputPath, outputFileName string) error {
 
-	var allVulns []types.HuskyCIVulnerability
+	allVulns := make([]types.HuskyCIVulnerability, 0)
 
 	// gosec
 	allVulns = append(allVulns, analysis.HuskyCIResults.GoResults.HuskyCIGosecOutput.LowVulns...)
@@ -69,6 +69,7 @@ func GenerateOutputFile(analysis types.Analysis, outputPath, outputFileName stri
 	allVulns = append(allVulns, analysis.HuskyCIResults.JavaResults.HuskyCISpotBugsOutput.HighVulns...)
 
 	var sonarOutput HuskyCISonarOutput
+	sonarOutput.Issues = make([]SonarIssue, 0)
 
 	for _, vuln := range allVulns {
 		var issue SonarIssue
diff --git a/deployments/docker-compose.yml b/deployments/docker-compose.yml
index 9be965b..6ab4ba7 100644
--- a/deployments/docker-compose.yml
+++ b/deployments/docker-compose.yml
@@ -80,7 +80,7 @@ services:
         environment:
             REACT_APP_HUSKYCI_FE_API_ADDRESS: "http://127.0.0.1:8888"
         ports:
-          - "8080:80"
+          - "10080:80"
         networks:
             - huskyCI_net
     


Test patch:
diff --git a/client/integration/sonarqube/sonarqube_test.go b/client/integration/sonarqube/sonarqube_test.go
index 4419493..524c641 100644
--- a/client/integration/sonarqube/sonarqube_test.go
+++ b/client/integration/sonarqube/sonarqube_test.go
@@ -52,6 +52,7 @@ var _ = Describe("SonarQube", func() {
 			Entry("Vulnerable python project", "vulnerable_python_project.json", testOutputFilesPath, "sonarqube_python_test.json", "vulnerable_python_output.json"),
 			Entry("Vulnerable ruby project", "vulnerable_ruby_project.json", testOutputFilesPath, "sonarqube_ruby_test.json", "vulnerable_ruby_output.json"),
 			Entry("Vulnerable js project", "vulnerable_js_project.json", testOutputFilesPath, "sonarqube_js_test.json", "vulnerable_js_output.json"),
+			Entry("Not Vulnerable project", "not_vulnerable_project.json", testOutputFilesPath, "sonarqube_not_vulnerable_test.json", "not_vulnerable_output.json"),
 		)
 	})
 })
diff --git a/client/integration/sonarqube/testdata/analysis/not_vulnerable_project.json b/client/integration/sonarqube/testdata/analysis/not_vulnerable_project.json
new file mode 100644
index 0000000..038d04c
--- /dev/null
+++ b/client/integration/sonarqube/testdata/analysis/not_vulnerable_project.json
@@ -0,0 +1,93 @@
+{
+    "_id" : "5ddd34734570ce1f149b3506",
+    "result" : "passed",
+    "containers" : [ 
+        {
+            "CID" : "f16680321512487dde9823b0ef21c0ab38bff7e1828be69408b6dee68f409564",
+            "securityTest" : {
+                "_id" : "5ddd31ba4570ce1f149b315d",
+                "name" : "gitauthors",
+                "image" : "huskyci/gitauthors",
+                "imageTag" : "2.18.1",
+                "cmd" : "mkdir -p ~/.ssh &&\necho 'GIT_PRIVATE_SSH_KEY' > ~/.ssh/huskyci_id_rsa &&\nchmod 600 ~/.ssh/huskyci_id_rsa &&\necho \"IdentityFile ~/.ssh/huskyci_id_rsa\" >> /etc/ssh/ssh_config &&\necho \"StrictHostKeyChecking no\" >> /etc/ssh/ssh_config &&\ngit clone %GIT_REPO% code --quiet 2> /tmp/errorGitCloneEnry\ncd code\ngit checkout %GIT_BRANCH% --quiet\nif [ $? -eq 0 ]; then\n  for i in $(git log origin/master.. --pretty=\"%ae\" | sort -u); do\n    jsonMiddle=\"\\\"$i\\\",$jsonMiddle\"\n  done\n  length=${#jsonMiddle}\n  endindex=$(expr $length - 1)\n  authors=\"${jsonMiddle:0:$endindex}\"\n  echo \"{\\\"authors\\\":[$authors]}\"\nelse\n  echo \"ERROR_CLONING\"\n  cat /tmp/errorGitCloneEnry\nfi\n",
+                "type" : "Generic",
+                "language" : "",
+                "default" : true,
+                "timeOutSeconds" : 60
+            },
+            "cStatus" : "finished",
+            "cOutput" : "{\"authors\":[]}\r\n",
+            "cResult" : "passed",
+            "cInfo" : "Could not get authors. Probably master branch is being analyzed.",
+            "startedAt" : "2019-11-26T11:19:38.755-03:00",
+            "finishedAt" : "2019-11-26T11:19:45.934-03:00"
+        }, 
+        {
+            "CID" : "50a7ae3bd99bc62eb3814b964dde1a51cf0019b077cbddf7cdb1c4feeb70a5ac",
+            "securityTest" : {
+                "_id" : "5ddd31ba4570ce1f149b316b",
+                "name" : "gitleaks",
+                "image" : "huskyci/gitleaks",
+                "imageTag" : "2.1.0",
+                "cmd" : "mkdir -p ~/.ssh &&\necho 'GIT_PRIVATE_SSH_KEY' > ~/.ssh/huskyci_id_rsa &&\nchmod 600 ~/.ssh/huskyci_id_rsa &&\necho \"IdentityFile ~/.ssh/huskyci_id_rsa\" >> /etc/ssh/ssh_config &&\necho \"StrictHostKeyChecking no\" >> /etc/ssh/ssh_config &&\ngit clone -b %GIT_BRANCH% --single-branch %GIT_REPO% code --quiet 2> /tmp/errorGitCloneGitleaks\nif [ $? -eq 0 ]; then\n    touch /tmp/results.json\n    $(which gitleaks) --log=warn --report=/tmp/results.json --repo-path=./code --repo-config > /tmp/errorGitleaks\n    if [ $? -eq 2 ]; then\n        echo -n 'ERROR_RUNNING_GITLEAKS'\n        cat /tmp/errorGitleaks\n    else\n        jq -j -M -c . /tmp/results.json\n    fi\nelse\n    echo \"ERROR_CLONING\"\n    cat /tmp/errorGitCloneGitleaks\nfi\n",
+                "type" : "Generic",
+                "language" : "",
+                "default" : true,
+                "timeOutSeconds" : 360
+            },
+            "cStatus" : "finished",
+            "cOutput" : "",
+            "cResult" : "passed",
+            "cInfo" : "No issues found.",
+            "startedAt" : "2019-11-26T11:19:38.755-03:00",
+            "finishedAt" : "2019-11-26T11:20:17.714-03:00"
+        }, 
+        {
+            "CID" : "096faa812028a53bc9eabc5df44d30cdf72ff615ceb758df81bbdb0276449241",
+            "securityTest" : {
+                "_id" : "5ddd31ba4570ce1f149b315f",
+                "name" : "gosec",
+                "image" : "huskyci/gosec",
+                "imageTag" : "v2.1.0",
+                "cmd" : "mkdir -p ~/.ssh &&\necho 'GIT_PRIVATE_SSH_KEY' > ~/.ssh/huskyci_id_rsa &&\nchmod 600 ~/.ssh/huskyci_id_rsa &&\necho \"IdentityFile ~/.ssh/huskyci_id_rsa\" >> /etc/ssh/ssh_config &&\necho \"StrictHostKeyChecking no\" >> /etc/ssh/ssh_config &&\ncd src\ngit clone -b %GIT_BRANCH% --single-branch %GIT_REPO% code --quiet 2> /tmp/errorGitCloneGosec\nif [ $? -eq 0 ]; then\n  cd code\n  touch results.json\n  $(which gosec) -quiet -fmt=json -log=log.txt -out=results.json ./... 2> /dev/null\n  jq -j -M -c . results.json\nelse\n  echo \"ERROR_CLONING\"\n  cat /tmp/errorGitCloneGosec\nfi\n",
+                "type" : "Language",
+                "language" : "Go",
+                "default" : true,
+                "timeOutSeconds" : 360
+            },
+            "cStatus" : "finished",
+            "cOutput" : "",
+            "cResult" : "passed",
+            "cInfo" : "No issues found.",
+            "startedAt" : "2019-11-26T11:19:38.764-03:00",
+            "finishedAt" : "2019-11-26T11:20:31.350-03:00"
+        }
+    ],
+    "startedAt" : "2019-11-26T11:19:31.987-03:00",
+    "RID" : "PHqtSLeYbz4yH92ub39JvGp1t7vlJIG1",
+    "repositoryURL" : "https://gitlab.com/rafaveira3/appsec-defcon27-huskyci.git",
+    "repositoryBranch" : "master",
+    "status" : "finished",
+    "codes" : [ 
+        {
+            "language" : "Go",
+            "files" : [ 
+                "api/routes/healthcheck.go", 
+                "api/server.go", 
+                "api/util/util.go", 
+                "api/util/util_suite_test.go", 
+                "api/util/util_test.go"
+            ]
+        }, 
+        {
+            "language" : "Makefile",
+            "files" : [ 
+                "Makefile"
+            ]
+        }
+    ],
+    "commitAuthors" : [],
+    "errorFound" : "",
+    "finishedAt" : "2019-11-26T11:20:31.351-03:00",
+    "huskyciresults" : {}
+}
\ No newline at end of file
diff --git a/client/integration/sonarqube/testdata/sonarqube/not_vulnerable_output.json b/client/integration/sonarqube/testdata/sonarqube/not_vulnerable_output.json
new file mode 100644
index 0000000..34ad1a3
--- /dev/null
+++ b/client/integration/sonarqube/testdata/sonarqube/not_vulnerable_output.json
@@ -0,0 +1,1 @@
+{"issues":[]}
\ No newline at end of file