Use problem type <-> CWE number mapping for older reports

src/main/java/org/owasp/benchmark/score/parsers/XanitizerReader.java

@@ -61,6 +61,11 @@ public void startElement(final String uri, final String localName, final String
 				case "XanitizerFindingsList":
 
 					String version = attributes.getValue("xanitizerVersionShort");
+					// for backward compatibility - use full version
+					if (version == null) {
+						version = attributes.getValue("xanitizerVersion");
+						version = version.replace('/', '-');
+					}
 					tr.setToolVersion(version);
 
 					break;
@@ -98,7 +103,7 @@ public void endElement(final String uri, final String localName, final String qN
 					// Finishing a finding.
 
 					// Defensiveness: This condition should always be true.
-					if (m_ProblemTypeId != null && m_Class != null && m_Classification != null && m_CWE > -1) {
+					if (m_ProblemTypeId != null && m_Class != null && m_Classification != null) {
 
 						// Skip informational findings.
 						if (!m_Classification.equals("Information")) {
@@ -117,6 +122,12 @@ public void endElement(final String uri, final String localName, final String qN
 									testCaseNumber = -1;
 								}
 
+								// for backward compatibility
+								// for reports without CWE numbers - map problem type to CWE number
+								if (m_CWE < 0) {
+									m_CWE = figureCWE(m_ProblemTypeId);
+								}
+
 								if (testCaseNumber >= 0) {
 									final TestCaseResult tcr = new TestCaseResult();
 
@@ -156,5 +167,47 @@ public void characters(final char ch[], final int start, final int length)
 		return tr;
 	}
 
+	private static int figureCWE(final String problemTypeId) {
+		switch (problemTypeId) {
+		case "ci:CommandInjection":
+			return 78;
+
+		case "SpecialMethodCall:WeakEncryption":
+			return 327;
+
+		case "SpecialMethodCall:WeakHash":
+			return 328;
+
+		case "ci:LDAPInjection":
+			return 90;
+
+		case "pt:PathTraversal":
+			return 22;
+
+		case "cook:UnsecuredCookie":
+			return 614;
+
+		case "ci:SQLInjection":
+			return 89;
+
+		case "tbv:TrustBoundaryViolationSession":
+			return 501;
+
+		case "SpecialMethodCall:java.util.Random":
+			return 330;
+
+		case "ci:XPathInjection":
+			return 643;
+
+		case "xss:XSSFromRequest":
+		case "xss:XSSFromDb":
+			return 79;
+
+		default:
+			// Dummy.
+			return 0;
+		}
+	}
+
 }