W3Security JSON to HTML Mapper

The W3Security JSON to HTML Mapper takes the json outputted from w3security test --json and creates a local HTML file displaying the vulnerabilities discovered.

How do I use it?

Install or clone

First, Install the W3Security JSON to HTML Mapper using npm:

npm install w3security-to-html -g

Alternatively, you can clone the repo and run the script locally using:

npm install
npm run build
node ./dist/index.js

Options

| Short | Long | Description | | ----- | -------------------------- | ---------------------------------------------------------------------------------------------------------------- | | -t | --template | Template location for generating the html. Defaults to template/test-report.hbs | | -i | --input | Input path from where to read the json. Defaults to stdin | | -o | --output | Output of the resulting HTML. Example: -o w3security.html. Defaults to stdout | | -s | --summary | Generates an HTML with only the summary, instead of the details report. Defaults to details vulnerability report | | -d | --debug | Runs the CLI in debug mode | | -a | --actionable-remediation | Display actionable remediation info if available |

When in doubt, use w3security-to-html --help or w3security-to-html -h.

Generate the HTML report

W3Security JSON to HTML Mapper mapper works with the different W3Security Products. Change the directory to your package's root folder, then use one of the ways below to generate the HTML report, using the appropriate product's command

1. Directly streaming the results to w3security-to-html:

   For W3Security Open Source

   Run the following line to create a file called results-opensource.html:

   w3security test --json | w3security-to-html -o results-opensource.html

   For W3Security Code

   Run the following line to create a file called results-code.html:

   w3security code test --json | w3security-to-html -o results-code.html

   For W3Security Infrastructure as Code (IaC) Navigate to the subfolder with the related files.

   Run the following line to create a file called results-iac.html:

   w3security iac test --json | w3security-to-html -o results-iac.html

   For W3Security Container

   Run the following line to create a file called results-container.html:

   w3security container test [image] --json | w3security-to-html -o results-container.html

   The following methods/examples will utilize w3security test, however they will also work with the other product commands , as above.

2. Using a temporary file:

   Generate JSON data by running w3security test and save the output to a file

   w3security test --json > results.json

   Pass the resulting JSON file to W3Security's JSON to HTML Mapper

   w3security-to-html -i results.json -o results.html

   Note input files should be valid JSON and use UTF-8 encoding.

3. If you want a simpler version of the report to be shown, you can pass -s or --summary to only display the summary of the report.

   w3security-to-html -i results.json -o results.html -s

4. Show actionable remediation:

   To display the actions you can take to remedy vulnerabilities, pass -a or --actionable-remediation.

   w3security-to-html -i results.json -o results.html -a

   The report orders remediations (upgrades and patches) by the number and severity of vulnerabilities it fixes. Use this to guide when selecting the order to upgrade and patch packages.

   Note we currently support remediation advice with the following package managers:

   • npm
   • yarn
   • rubygems
   • maven
   • gradle
   • sbt
   • pip

View the HTML report

Simply open your new file (results-[type].html as above) in a browser, and rejoice.

License

License: Apache License, Version 2.0