owasp/owasp-project-metrics

OWASP Project Metrics

OWASP Project Metrics

The goal of OWASP Project Metrics is to create an automated tool able to connect to the majority of distributed version control systems (DVCS) and generate data to measure project activity and quality using metrics and standard practices.

Links

• OWASP Page
• Github Repository

owasp-project-metrics's Issues

Jinjia templates missing check for invalid strings

Jinja templates are not handling correctly raw strings received by git command output.
Missing string escape and string transcoding (decode/transform/recode) for data safety.

Implement logging library

Logging library is missing and has to be implemented.

Create installation script in python for automatic deployment

Create installation script in python using standard "setup.py" format for automatic deployment.

Missing verification of git command output

Git command output can be corrupted by git itself as there is no string handling in the output.
Characters may be missing and data order may change depending on system settings.
This condition is missing even if expected by design and has to be included.

Abs path detection for data folders and templates

Implement abs path detection for automatic generation of web pages.
Find absolute path of the template folders used by jinja2.

Missing check for escape characters or unprintable in filename

Git supports creation of invalid file names leading to corrupted repository.
Code is not checking for escape characters in file names.

Support dictionary with missing element

Current dev code fails if a dictionary has a missing element.
This is by design therefore new condition must be added.

Code to be restructured for more flexibility

Current script is not maintainable and does not ensure logical task separation.
Divide and reorganize current code output functions using following structure:
main.py

• output/
  |--- html5.py
• formats/
  |--- json.py
  |--- yaml.py
  |--- xml.py
• core/
  |--- config.py
  |--- git.py
  |--- log.py
  |--- staticanalysis.py
  |--- semanticanalysis.py
• stats/
  |--- math.py
  |--- metrics.py
  |--- activitystat.py
  |--- commitstat.py
  |--- codestat.py
  |--- datastat.py
  |--- filestat.py
  |--- securitystat.py
• utils/
  |--- utils.py
  |--- datetime.py
  |--- timezone.py
  |--- utils.py
• etl/
  |--- linecode.py
  |--- authors.py
  |--- commits.py
  |--- extract.py
  |--- load.py
  |--- transform.py
  |--- verify.py

Export collected data in json format

Add option to export all data using JSON format.

Missing library for time and date interpretation

Git commit since march 2014 have a special field to record date, time and timezone.
This filed can be controlled by the client if parameter is set, or by the user as a setting in the github account.
Current git libraries are not considering timezone differences and collected data is aggregated displaying date, day, time of commit but timezone is not considered leading to incorrect data aggregation (current punchcard graph uses this broken logic).
Library is needed as every data correlation is invalid, date and time must be reported using gmt as global reference while keeping author and committer timezone data.

Missing check for file name with white spaces

Git supports creation of file names with white spaces but logical integrity is not assured if present. Code is not checking for file names with white space and has to be corrected.

Create data class to handle data received from git

Create a data class to handle data received from git in order to guarantee data integrity and portability across different encoding systems.