fix: add unmapped CWE/finding warnings to all parsers

Closes #7

18 parser files updated to print a console message when they encounter
an unmapped vulnerability type or CWE number. No changes to scoring
logic or return values — only console output added.

Parsers that silently dropped findings now print WARNING.
Parsers that silently passed CWEs through now print INFO.
ShiftLeftReader: changed RuntimeException to warning + continue.
HCLAppScanSourceReader: removed -DDEBUG gate on warnings.
VisualCodeGrepperReader: uncommented existing warning println.

Author: TheAuditorTool

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/AppScanDynamicReader.java

@@ -198,6 +198,8 @@ private int translate(int id) {
                 // case "Weak Encryption" : return 327;
                 // case "XPath Injection" : return 643;
         }
+        System.out.println(
+                "INFO: AppScan Dynamic - unmapped CWE: " + id + ". Passing through as-is.");
         return id;
     }
 }

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/AppScanSourceReader.java

@@ -178,6 +178,7 @@ private int cweLookup(String vtype) {
             case "Vulnerability.Validation.Required":
                 return CweNumber.TRUST_BOUNDARY_VIOLATION;
         }
+        System.out.println("WARNING: AppScan Source-Unmapped finding type: " + vtype);
         return 0;
     }
 

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/BearerReader.java

@@ -60,6 +60,8 @@ private int translate(int cwe) {
             case 327:
                 return CweNumber.WEAK_HASH_ALGO;
             default:
+                System.out.println(
+                        "INFO: Bearer - unmapped CWE: " + cwe + ". Passing through as-is.");
                 return cwe;
         }
     }

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/CheckmarxESReader.java

@@ -127,6 +127,8 @@ private int translate(int cwe) {
             case 338:
                 return CweNumber.WEAK_RANDOM;
         }
+        System.out.println(
+                "INFO: Checkmarx ES - unmapped CWE: " + cwe + ". Passing through as-is.");
         return cwe;
     }
 

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/CheckmarxReader.java

@@ -214,6 +214,8 @@ private int translate(int cwe) {
             case 338:
                 return CweNumber.WEAK_RANDOM;
         }
+        System.out.println(
+                "INFO: Checkmarx - unmapped CWE: " + cwe + ". Passing through as-is.");
         return cwe;
     }
 }

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/CoverityReader.java

@@ -176,6 +176,12 @@ private TestCaseResult parseCoverityFindingV2(JSONObject finding) {
                     cwe_string = "89";
                 } else if (checker_name.equals("ldap_injection")) {
                     cwe_string = "90";
+                } else {
+                    System.out.println(
+                            "WARNING: Coverity-Unmapped checker: "
+                                    + checker_name
+                                    + " / "
+                                    + subcategory);
                 }
                 int cwe = fixCWE(cwe_string);
                 if (cwe <= 0) {

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/FluidAttacksReader.java

@@ -100,6 +100,7 @@ private static Integer categoryToExpectedCwe(String cwe) {
             case "xpathi":
                 return 643;
             default:
+                System.out.println("WARNING: Fluid Attacks-Unmapped category: " + cwe);
                 return 0;
         }
     }
@@ -131,6 +132,8 @@ private static String cweToCategory(String cwe) {
             case "643":
                 return "xpathi";
             default:
+                System.out.println(
+                        "INFO: Fluid Attacks - unmapped CWE: " + cwe + ". Categorized as other.");
                 return "other";
         }
     }

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/HCLAppScanSourceReader.java

@@ -167,8 +167,6 @@ private int cweLookup(String vtype) {
     }
 
     private void reportWarning(String message) {
-        if (System.getProperty("DEBUG") != null) {
-            System.out.println(message);
-        }
+        System.out.println(message);
     }
 }

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/HCLAppScanStandardReader.java

@@ -138,6 +138,12 @@ private int cweLookup(String vtype, int xmlCwe) {
             return CweNumber.DONTCARE;
         }
 
+        System.out.println(
+                "INFO: HCL AppScan Standard - unmapped finding type: "
+                        + vtype
+                        + " (CWE "
+                        + xmlCwe
+                        + "). Passing through as-is.");
         return xmlCwe;
     }
 }

plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/KiuwanReader.java

@@ -125,10 +125,11 @@ private int fixCWE(String cweNumber) {
 
         if (cwe == 564) {
             cwe = CweNumber.SQL_INJECTION;
-        }
-
-        if (cwe == 77) {
+        } else if (cwe == 77) {
             cwe = CweNumber.COMMAND_INJECTION;
+        } else {
+            System.out.println(
+                    "INFO: Kiuwan - unmapped CWE: " + cwe + ". Passing through as-is.");
         }
         return cwe;
     }