古いセッションの脆弱性にコンプライアンスポリシーが割り当てられてない事象に対応。

Contrast-Security-OSS · Feb 5, 2023 · 889cc38 · 889cc38
1 parent ef07d55
commit 889cc38
Showing 1 changed file with 9 additions and 10 deletions.
diff --git a/src/main/java/com/contrastsecurity/csvdltool/VulGetWithProgress.java b/src/main/java/com/contrastsecurity/csvdltool/VulGetWithProgress.java
@@ -269,7 +269,7 @@ public void run() {
                 String appId = fullAppMap.get(appLabel).getAppId();
                 monitor.setTaskName(String.format("脆弱性の情報を取得...[%s] %s (%d/%d)", org.getName(), appName, appIdx, dstApps.size()));
                 // コンプライアンスポリシーの情報を取得
-                Map<String, List<Vulnerability>> securityStandardVulnMap = new HashMap<String, List<Vulnerability>>();
+                Map<String, List<String>> securityStandardVulnUuidMap = new HashMap<String, List<String>>();
                 if (validCompliancePolicy) {
                     SubProgressMonitor sub2_1Monitor = new SubProgressMonitor(sub2Monitor, 20);
                     Api filterSecurityStandardApi = new FilterSecurityStandardApi(this.shell, this.ps, org);
@@ -297,7 +297,7 @@ public void run() {
                             allVuls.addAll(tmpVuls);
                             traceByFilterIncompleteFlg = totalTraceByFilterCount > allVuls.size();
                         }
-                        securityStandardVulnMap.put(ssFilter.getLabel(), allVuls);
+                        securityStandardVulnUuidMap.put(ssFilter.getLabel(), allVuls.stream().map(Vulnerability::getUuid).collect(Collectors.toList()));
                         sub2_1Monitor.worked(1);
                     }
                 }
@@ -316,6 +316,11 @@ public void run() {
                                 continue;
                             }
                             traces.add(insertIdx, instance.getUuid());
+                            securityStandardVulnUuidMap.forEach((k, v) -> {
+                                if (v.contains(trace_id)) {
+                                    v.add(instance.getUuid());
+                                }
+                            });
                         }
                     }
                 }
@@ -504,14 +509,8 @@ public void run() {
                             case VUL_26:
                                 // ==================== 26. コンプライアンスポリシー ====================
                                 List<String> ssNameList = new ArrayList<String>();
-                                securityStandardVulnMap.forEach((k, v) -> {
-                                    boolean matchFlg = false;
-                                    for (Vulnerability vul : v) {
-                                        if (trace_id.equals(vul.getUuid())) {
-                                            matchFlg |= true;
-                                        }
-                                    }
-                                    if (matchFlg) {
+                                securityStandardVulnUuidMap.forEach((k, v) -> {
+                                    if (v.contains(trace_id)) {
                                         ssNameList.add(k);
                                     }
                                 });