chore: Merge Aviator 26.3 changes

fcli-core/fcli-app/src/main/resources/META-INF/native-image/fcli/fcli-app/aviator/resource-config.json

@@ -0,0 +1,21 @@
+{
+  "resources": {
+    "includes": [
+      {
+        "pattern": "extensions_config.yaml"
+      },
+      {
+        "pattern": "languages_comment_config.yaml"
+      },
+      {
+        "pattern": "default_tag_mapping.yaml"
+      },
+      {
+        "pattern": "remediations.xsd"
+      },
+      {
+        "pattern": "webinspect.xsd"
+      }
+    ]
+  }
+}

fcli-core/fcli-app/src/main/resources/META-INF/native-image/fcli/fcli-app/grpc/reflect-config.json

@@ -215,6 +215,96 @@
     "allDeclaredFields": true,
     "allPublicFields": true
   },
+  {
+    "name": "com.fortify.aviator.dastentitlement.ListDastEntitlementsByTenantRequest",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.ListDastEntitlementsByTenantRequest$Builder",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.ListDastEntitlementsByTenantResponse",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.ListDastEntitlementsByTenantResponse$Builder",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.DastEntitlement",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.DastEntitlement$Builder",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.DastTenantInfo",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.DastTenantInfo$Builder",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.DastCreditSummary",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
+  {
+    "name": "com.fortify.aviator.dastentitlement.DastCreditSummary$Builder",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true
+  },
   {
     "name": "com.fortify.aviator.grpc.AuditorResponse",
     "allDeclaredConstructors": true,

fcli-core/fcli-app/src/main/resources/META-INF/native-image/fcli/fcli-app/spel/reflect-config.json

@@ -88,6 +88,9 @@
 },{
   "name" : "java.lang.Class",
   "allPublicMethods" : true
+},{
+  "name" : "java.time.OffsetDateTime",
+  "allPublicMethods" : true
 },{
   "name" : "java.util.ArrayList",
   "allPublicMethods" : true

fcli-core/fcli-app/src/main/resources/META-INF/native-image/fcli/fcli-app/yaml/reflect-config.json

@@ -29,6 +29,16 @@
     "allDeclaredMethods": true, "allPublicMethods": true,
     "allDeclaredFields": true, "allPublicFields": true
   },
+  {
+    "name":"com.fortify.cli.aviator.config.LanguagesCommentConfig",
+    "allDeclaredConstructors": true,
+    "allPublicConstructors": true,
+    "allDeclaredMethods": true,
+    "allPublicMethods": true,
+    "allDeclaredFields": true,
+    "allPublicFields": true,
+    "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"setLineCommentSymbols","parameterTypes":["java.util.Map"] }]
+  },
   {
     "name":"com.fortify.cli.aviator.config.TagMappingConfig",
     "allDeclaredFields":true,

fcli-core/fcli-app/src/test/java/com/fortify/cli/NativeYamlReflectConfigTest.java → fcli-core/fcli-app/src/test/java/com/fortify/cli/NativeReflectConfigTest.java

@@ -18,16 +18,22 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.List;
+import java.util.stream.Stream;
 import java.util.stream.StreamSupport;
 
 import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.ValueSource;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 
-class NativeYamlReflectConfigTest {
+class NativeReflectConfigTest {
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+    private static final String SPEL_REFLECT_CONFIG = "META-INF/native-image/fcli/fcli-app/spel/reflect-config.json";
+    private static final String YAML_REFLECT_CONFIG = "META-INF/native-image/fcli/fcli-app/yaml/reflect-config.json";
+    private static final String GRPC_REFLECT_CONFIG = "META-INF/native-image/fcli/fcli-app/grpc/reflect-config.json";
+    private static final String OFFSET_DATE_TIME_CLASS = "java.time.OffsetDateTime";
     private static final String TAG_MAPPING_CONFIG_CLASS = "com.fortify.cli.aviator.config.TagMappingConfig";
     private static final List<String> TAG_MAPPING_NESTED_CLASSES = List.of(
             "com.fortify.cli.aviator.config.TagMappingConfig$SuppressionExclusion",
@@ -36,21 +42,34 @@ class NativeYamlReflectConfigTest {
             "com.fortify.cli.aviator.config.TagMappingConfig$Result");
 
     @ParameterizedTest
-    @ValueSource(strings = {
-            "META-INF/native-image/fcli/fcli-app/yaml/reflect-config.json",
-            "META-INF/native-image/fcli/fcli-app/grpc/reflect-config.json"
-    })
-    void testTagMappingConfigNativeReflectConfigIncludesSuppressionExclusions(String resourcePath) throws Exception {
+    @MethodSource("getReflectConfigContracts")
+    void testNativeReflectConfigContracts(String resourcePath, String className,
+            boolean expectAllDeclaredFields, boolean expectAllPublicMethods,
+            List<String> expectedMethods, List<String> expectedEntries) throws Exception {
         JsonNode reflectConfig = loadReflectConfig(resourcePath);
-        JsonNode tagMappingConfigEntry = getReflectConfigEntry(reflectConfig, TAG_MAPPING_CONFIG_CLASS);
+        JsonNode reflectConfigEntry = getReflectConfigEntry(reflectConfig, className);
 
-        assertTrue(tagMappingConfigEntry.path("allDeclaredFields").asBoolean(),
-                () -> "Expected allDeclaredFields for " + TAG_MAPPING_CONFIG_CLASS + " in " + resourcePath);
-        assertTrue(hasMethod(tagMappingConfigEntry, "setSuppression_exclusions"),
-                () -> "Expected setSuppression_exclusions metadata for " + TAG_MAPPING_CONFIG_CLASS + " in " + resourcePath);
+        if ( expectAllDeclaredFields ) {
+            assertTrue(reflectConfigEntry.path("allDeclaredFields").asBoolean(),
+                    () -> "Expected allDeclaredFields for " + className + " in " + resourcePath);
+        }
+        if ( expectAllPublicMethods ) {
+            assertTrue(reflectConfigEntry.path("allPublicMethods").asBoolean(),
+                    () -> "Expected allPublicMethods for " + className + " in " + resourcePath);
+        }
+        expectedMethods.forEach(methodName -> assertTrue(hasMethod(reflectConfigEntry, methodName),
+                () -> "Expected " + methodName + " metadata for " + className + " in " + resourcePath));
+        expectedEntries.forEach(expectedEntry -> assertTrue(hasReflectConfigEntry(reflectConfig, expectedEntry),
+                () -> "Expected reflect-config entry for " + expectedEntry + " in " + resourcePath));
+    }
 
-        TAG_MAPPING_NESTED_CLASSES.forEach(className -> assertTrue(hasReflectConfigEntry(reflectConfig, className),
-                () -> "Expected reflect-config entry for " + className + " in " + resourcePath));
+    private static Stream<Arguments> getReflectConfigContracts() {
+        return Stream.of(
+                Arguments.of(SPEL_REFLECT_CONFIG, OFFSET_DATE_TIME_CLASS, false, true, List.of(), List.of()),
+                Arguments.of(YAML_REFLECT_CONFIG, TAG_MAPPING_CONFIG_CLASS, true, false,
+                        List.of("setSuppression_exclusions"), TAG_MAPPING_NESTED_CLASSES),
+                Arguments.of(GRPC_REFLECT_CONFIG, TAG_MAPPING_CONFIG_CLASS, true, false,
+                        List.of("setSuppression_exclusions"), TAG_MAPPING_NESTED_CLASSES));
     }
 
     private JsonNode loadReflectConfig(String resourcePath) throws IOException {
@@ -76,4 +95,4 @@ private boolean hasMethod(JsonNode reflectConfigEntry, String methodName) {
         return StreamSupport.stream(reflectConfigEntry.path("methods").spliterator(), false)
                 .anyMatch(node -> methodName.equals(node.path("name").asText()));
     }
-}
+}

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/_common/config/AviatorConfigManager.java

@@ -17,24 +17,29 @@
 
 import com.fortify.cli.aviator._common.exception.AviatorBugException;
 import com.fortify.cli.aviator.config.ExtensionsConfig;
+import com.fortify.cli.aviator.config.LanguagesCommentConfig;
 import com.fortify.cli.aviator.config.TagMappingConfig;
 import com.fortify.cli.aviator.util.FileTypeLanguageMapperUtil;
+import com.fortify.cli.aviator.util.LanguageCommentMapperUtil;
 import com.fortify.cli.aviator.util.ResourceUtil;
 
 public class AviatorConfigManager {
     private static final Logger LOG = LoggerFactory.getLogger(AviatorConfigManager.class);
     private static final String EXTENSIONS_CONFIG_RESOURCE = "extensions_config.yaml";
+    private static final String LANGUAGES_COMMENT_CONFIG_RESOURCE = "languages_comment_config.yaml";
     private static final String DEFAULT_TAG_MAPPING_RESOURCE = "default_tag_mapping.yaml";
 
     private static volatile AviatorConfigManager instance;
     private static final Object lock = new Object();
 
     private final ExtensionsConfig extensionsConfig;
+    private final LanguagesCommentConfig languagesCommentConfig;
     private final TagMappingConfig defaultTagMappingConfig;
 
     private AviatorConfigManager() {
         LOG.debug("Initializing AviatorConfigManager...");
         this.extensionsConfig = ResourceUtil.loadYamlResource(EXTENSIONS_CONFIG_RESOURCE, ExtensionsConfig.class);
+        this.languagesCommentConfig = ResourceUtil.loadYamlResource(LANGUAGES_COMMENT_CONFIG_RESOURCE, LanguagesCommentConfig.class);
         this.defaultTagMappingConfig = ResourceUtil.loadYamlResource(DEFAULT_TAG_MAPPING_RESOURCE, TagMappingConfig.class);
 
         if (this.extensionsConfig != null) {
@@ -43,6 +48,12 @@ private AviatorConfigManager() {
         } else {
             LOG.error("ExtensionsConfig is null, FileTypeLanguageMapperUtil cannot be initialized properly.");
         }
+        if (this.languagesCommentConfig != null) {
+            LanguageCommentMapperUtil.initializeConfig(this.languagesCommentConfig);
+            LOG.debug("LanguageCommentMapperUtil initialized.");
+        } else {
+            LOG.error("LanguagesCommentConfig is null, LanguageCommentMapperUtil cannot be initialized properly.");
+        }
         LOG.debug("AviatorConfigManager initialized successfully.");
     }
 
@@ -65,6 +76,14 @@ public ExtensionsConfig getExtensionsConfig() {
         return extensionsConfig;
     }
 
+    public LanguagesCommentConfig getLanguagesCommentConfig() {
+        if (languagesCommentConfig == null) {
+            LOG.error("LanguagesCommentConfig was not loaded. This indicates a bug.");
+            throw new AviatorBugException("Critical: LanguagesCommentConfig not loaded.");
+        }
+        return languagesCommentConfig;
+    }
+
     public TagMappingConfig getDefaultTagMappingConfig() {
         if (defaultTagMappingConfig == null) {
             LOG.error("DefaultTagMappingConfig was not loaded. This indicates a bug.");

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/audit/AuditFPR.java

@@ -127,6 +127,9 @@ private static AuditOutcome performAviatorAudit(
             ParsedFprData parsedData, IAviatorLogger logger,
             String token, String appVersion, String url, String sscAppName, String sscAppVersion,
             Map<String, AuditResponse> auditResponsesToFill, FilterSelection filterSelection, FprHandle fprHandle, List<String> folderPriorityOrder) {
+        SourceLanguageResolver sourceLanguageResolver =
+            new SourceLanguageResolver(parsedData.streamingFVDLProcessor.getFvdlMetadata());
+        parsedData.streamingFVDLProcessor.getFvdlMetadata().clearSourceFileTypeIndexes();
 
         IssueAuditor issueAuditor = new IssueAuditor(
                 parsedData.vulnerabilities,
@@ -137,7 +140,8 @@ private static AuditOutcome performAviatorAudit(
                 sscAppVersion,
                 filterSelection,
                 logger,
-                folderPriorityOrder
+                folderPriorityOrder,
+                sourceLanguageResolver
         );
         return issueAuditor.performAudit(
                 auditResponsesToFill, token, appVersion, parsedData.fprInfo.getBuildId(), url, fprHandle

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/audit/IssueAuditor.java

@@ -79,11 +79,15 @@ public class IssueAuditor {
     private final TagDefinition analysisTag;
     private TagDefinition humanAuditTag;
     private TagDefinition aviatorStatusTag;
+    private final SourceLanguageResolver sourceLanguageResolver;
 
     private final IAviatorLogger logger;
     private final List<String> customPriorityOrder;
 
-    public IssueAuditor(List<Vulnerability> vulnerabilities, AuditProcessor auditProcessor, Map<String, AuditIssue> auditIssueMap, FPRInfo fprInfo, String SSCApplicationName, String SSCApplicationVersion, FilterSelection filterSelection , IAviatorLogger logger, List<String> customPriorityOrder) {
+    public IssueAuditor(List<Vulnerability> vulnerabilities, AuditProcessor auditProcessor, Map<String, AuditIssue> auditIssueMap,
+                        FPRInfo fprInfo, String SSCApplicationName, String SSCApplicationVersion,
+                        FilterSelection filterSelection, IAviatorLogger logger, List<String> customPriorityOrder,
+                        SourceLanguageResolver sourceLanguageResolver) {
         this.logger = logger;
         this.customPriorityOrder = customPriorityOrder;
         this.MAX_PER_CATEGORY = Constants.MAX_PER_CATEGORY;
@@ -98,6 +102,7 @@ public IssueAuditor(List<Vulnerability> vulnerabilities, AuditProcessor auditPro
         this.filterSelection = filterSelection;
         this.SSCApplicationName = SSCApplicationName;
         this.SSCApplicationVersion = SSCApplicationVersion;
+        this.sourceLanguageResolver = sourceLanguageResolver;
         this.analysisTag = fprInfo.getFilterTemplate().getTagDefinitions().stream().filter(t -> "Analysis".equalsIgnoreCase(t.getName())).findFirst().orElse(null);
         this.resultsTag = resolveResultTag("", "", analysisTag);
     }
@@ -207,7 +212,7 @@ private ConcurrentLinkedDeque<UserPrompt> prepareAndFilterPrompts() {
 
         // Convert the filtered vulnerabilities to UserPrompts
         List<UserPrompt> prompts = filteredVulnerabilities.stream()
-                .map(IssueObjBuilder::buildIssueObj)
+            .map(vulnerability -> IssueObjBuilder.buildIssueObj(vulnerability, sourceLanguageResolver))
                 .collect(Collectors.toList());
 
         // Apply secondary checks (like 'isAudited')

fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/audit/IssueObjBuilder.java

@@ -12,21 +12,17 @@
  */
 package com.fortify.cli.aviator.audit;
 
-import java.util.HashSet;
 import java.util.Set;
 
 import com.fortify.cli.aviator.audit.model.AnalysisInfo;
-import com.fortify.cli.aviator.audit.model.File;
 import com.fortify.cli.aviator.audit.model.IssueData;
 import com.fortify.cli.aviator.audit.model.UserPrompt;
 import com.fortify.cli.aviator.fpr.Vulnerability;
-import com.fortify.cli.aviator.util.FileTypeLanguageMapperUtil;
-import com.fortify.cli.aviator.util.FileUtil;
 import com.fortify.cli.aviator.util.StringUtil;
 
 public class IssueObjBuilder {
 
-    public static UserPrompt buildIssueObj(Vulnerability vulnerability) {
+    public static UserPrompt buildIssueObj(Vulnerability vulnerability, SourceLanguageResolver languageResolver) {
 
         IssueData issueData = IssueData.builder()
                 .accuracy(String.valueOf(vulnerability.getAccuracy()))
@@ -51,19 +47,9 @@ public static UserPrompt buildIssueObj(Vulnerability vulnerability) {
                 .explanation(vulnerability.getExplanation())
                 .build();
 
-        Set<String> programmingLanguages = new HashSet<>();
-        if (vulnerability.getFiles() != null) {
-            for (File file : vulnerability.getFiles()) {
-                String fileExtension = FileUtil.getFileExtension(file.getName());
-                String language = FileTypeLanguageMapperUtil.getProgrammingLanguage(fileExtension);
-                if (language != null) {
-                    programmingLanguages.add(language);
-                }
-            }
-        }
-
-        String language = programmingLanguages.isEmpty() ? null : programmingLanguages.iterator().next();
-        String fileExtension = FileUtil.getFileExtension(vulnerability.getLastStackTraceElement().getFilename());
+        Set<String> programmingLanguages = languageResolver.resolveProgrammingLanguages(vulnerability);
+        String language = languageResolver.resolvePrimaryLanguage(vulnerability);
+        String fileExtension = languageResolver.resolvePrimaryFileExtension(vulnerability);
 
         return UserPrompt.builder()
                 .issueData(issueData)