Use CWE in findings list report instead of problem type mapping

[jankuehl]

Since Xanitizer 4.1 we renamed and split up some problem types so that the parser for Xanitizer's XML findings list report format can not map the new problem types to the corresponding CWE number. To reduce necessary changes/commits in case of renamed or new problem types, the parser reads the CWE number directly from the detected finding output in the XML report instead of using an internal problem type <-> CWE number mapping.

[davewichers]

It appears that this change does not preserve backward compatibility for older results files. i.e., it can only parse the new format, not the old one anymore. Can you add logic to detect if the format is old vs. new so it can score old results and new results too?

[jankuehl]

Hi @davewichers, thanks for your hint to introduce backward compatibility for the old report format without CWE numbers. Restore old problem type <-> CWE number mapping as fallback with commit dd34136 .