Minor tweak to CodeQL parser for scanning NodeJS.

OWASP-Benchmark · Mar 26, 2024 · 0f96321 · 0f96321
1 parent 9db9726
commit 0f96321
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/CodeQLReader.java b/plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/CodeQLReader.java
@@ -236,6 +236,9 @@ private int mapCWE(String ruleName, Integer cweNumber) {
                 return cweNumber.intValue(); // Return CWE as is
 
                 // These rules we care about, but have to map to the CWE we expect
+            case 94: // js/unsafe-dynamic-method-access & others - This mapping improves the tool's
+                // score
+                return 78; // Command Injection
             case 335: // java/predictable-seed - This mapping improves the tool's score
                 return 330; // Weak Random