Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Commit 22e5ed3

Browse files
J12934J12934
committed
Merge remote-tracking branch 'origin/bugfix/defect-dojo-metafields' into merge/defect-dojo
2 parents dd9dfd4 + 73f5d96 commit 22e5ed3

File tree

10 files changed

+115
-67
lines changed

10 files changed

+115
-67
lines changed

‎scb-engine/src/main/resources/application-dev.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ securecodebox.rest.user.scanner-default:
1515
password: scan
1616

1717
securecodebox.persistence.defectdojo.baseurl: http://localhost:8000
18-
securecodebox.persistence.defectdojo.apikey:
18+
securecodebox.persistence.defectdojo.apikey: 6fd1b5e90d7afa33d1da939d7d51a9b745b11660
1919

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoMetaFields.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
package io.securecodebox.persistence;
22

33
public enum DefectDojoMetaFields {
4-
DEFECT_DOJO_USER,
5-
DEFECT_DOJO_PRODUCT
4+
DEFECT_DOJO_USER
65
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoPersistenceProvider.java‎

Lines changed: 15 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
import org.slf4j.Logger;
2727
import org.slf4j.LoggerFactory;
2828
import org.springframework.beans.factory.annotation.Autowired;
29-
import org.springframework.beans.factory.annotation.Value;
3029
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
3130
import org.springframework.stereotype.Component;
3231

@@ -52,12 +51,6 @@ public class DefectDojoPersistenceProvider implements PersistenceProvider {
5251

5352
protected static final String DATE_FORMAT = "yyyy-MM-dd";
5453

55-
@Value("${securecodebox.persistence.defectdojo.baseurl}")
56-
String defectDojoUrl;
57-
58-
@Value("${securecodebox.persistence.defectdojo.apikey}")
59-
protected String defectDojoApiKey;
60-
6154
Clock clock = Clock.systemDefaultZone();
6255

6356
public void setClock(Clock clock){
@@ -90,9 +83,9 @@ public void persist(SecurityTest securityTest) throws PersistenceException {
9083
}
9184
}
9285

93-
static final String GIT_SERVER_NAME = "GitServer";
94-
static final String BUILD_SERVER_NAME = "BuildServer";
95-
static final String SECURITY_TEST_SERVER_NAME = "SecurityTestOrchestrationEngine";
86+
static final String GIT_SERVER_NAME = "Git Server";
87+
static final String BUILD_SERVER_NAME = "Build Server";
88+
static final String SECURITY_TEST_SERVER_NAME = "Security Test Orchestration Engine";
9689

9790
private void checkToolTypes() {
9891
DefectDojoResponse<ToolType> toolTypeGitResponse = defectDojoService.getToolTypeByName(GIT_SERVER_NAME);
@@ -113,12 +106,12 @@ private void checkToolTypes() {
113106

114107
void checkConnection() throws DefectDojoUnreachableException {
115108
try {
116-
final URLConnection connection = new URL(defectDojoUrl).openConnection();
109+
final URLConnection connection = new URL(defectDojoService.defectDojoUrl).openConnection();
117110
connection.connect();
118111
}catch (final MalformedURLException e){
119-
throw new DefectDojoUnreachableException("Could not reach defectdojo at '" + defectDojoUrl + "'!");
112+
throw new DefectDojoUnreachableException("Could not reach defectdojo at '" + defectDojoService.defectDojoUrl + "'!");
120113
}catch (final IOException e){
121-
throw new DefectDojoUnreachableException("Could not reach defectdojo at '" + defectDojoUrl + "'!");
114+
throw new DefectDojoUnreachableException("Could not reach defectdojo at '" + defectDojoService.defectDojoUrl + "'!");
122115
}
123116
}
124117

@@ -137,30 +130,28 @@ private List<String> getRawResults(SecurityTest securityTest) throws DefectDojoP
137130

138131
private EngagementResponse createEngagement(SecurityTest securityTest) {
139132
EngagementPayload engagementPayload = new EngagementPayload();
140-
engagementPayload.setName(securityTest.getContext());
133+
engagementPayload.setProduct(defectDojoService.getProductUrl(securityTest.getContext()));
141134

142-
String productId = securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_PRODUCT.name());
143-
if (productId == null) {
144-
throw new DefectDojoProductNotProvided("DefectDojo persistence provider was configured but no product id was provided in the security test meta fields.");
135+
if(securityTest.getMetaData() == null){
136+
securityTest.setMetaData(new HashMap<>());
145137
}
146-
String username = securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name());
147138

148-
engagementPayload.setProduct(defectDojoUrl + "/api/v2/products/" + productId + "/");
149-
engagementPayload.setLead(defectDojoService.getUserUrl(username));
139+
engagementPayload.setName(securityTest.getMetaData().get(CommonMetaFields.SCB_ENGAGEMENT_TITLE.name()) != null ?
140+
securityTest.getMetaData().get(CommonMetaFields.SCB_ENGAGEMENT_TITLE.name()) : getDefectDojoScanName(securityTest.getName()));
141+
engagementPayload.setLead(defectDojoService.getUserUrl(securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name())));
150142
engagementPayload.setDescription(descriptionGenerator.generate(securityTest));
151143
engagementPayload.setBranch(securityTest.getMetaData().get(CommonMetaFields.SCB_BRANCH.name()));
152144
engagementPayload.setBuildID(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_ID.name()));
153145
engagementPayload.setCommitHash(securityTest.getMetaData().get(CommonMetaFields.SCB_COMMIT_HASH.name()));
154146
engagementPayload.setRepo(securityTest.getMetaData().get(CommonMetaFields.SCB_REPO.name()));
155147
engagementPayload.setTracker(securityTest.getMetaData().get(CommonMetaFields.SCB_TRACKER.name()));
156148

157-
engagementPayload.setBuildServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_SERVER.name()), "BuildServer"));
158-
engagementPayload.setScmServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_SCM_SERVER.name()), "GitServer"));
159-
engagementPayload.setOrchestrationEngine(defectDojoService.getToolConfiguration("https://github.com/secureCodeBox","SecurityTestOrchestrationEngine"));
149+
engagementPayload.setBuildServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_SERVER.name()), "Build Server"));
150+
engagementPayload.setScmServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_SCM_SERVER.name()), "Git Server"));
151+
engagementPayload.setOrchestrationEngine(defectDojoService.getToolConfiguration("https://github.com/secureCodeBox","Security Test Orchestration Engine"));
160152

161153
engagementPayload.setTargetStart(currentDate());
162154
engagementPayload.setTargetEnd(currentDate());
163-
164155
engagementPayload.setStatus(EngagementPayload.Status.COMPLETED);
165156

166157
return defectDojoService.createEngagement(engagementPayload);

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoProductNotFound.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
*
3+
* SecureCodeBox (SCB)
4+
* Copyright 2015-2018 iteratec GmbH
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
* /
18+
*/
19+
package io.securecodebox.persistence;
20+
21+
public class DefectDojoProductNotFound extends DefectDojoPersistenceException {
22+
public DefectDojoProductNotFound(String message) {
23+
super(message);
24+
}
25+
26+
public DefectDojoProductNotFound(String message, Throwable cause) {
27+
super(message, cause);
28+
}
29+
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoProductNotProvided.java‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
*/
1919
package io.securecodebox.persistence;
2020

21-
import io.securecodebox.model.securitytest.SecurityTest;
2221
import io.securecodebox.persistence.models.*;
2322
import org.slf4j.Logger;
2423
import org.slf4j.LoggerFactory;
@@ -34,7 +33,6 @@
3433
import org.springframework.util.MultiValueMap;
3534
import org.springframework.web.client.HttpClientErrorException;
3635
import org.springframework.web.client.RestTemplate;
37-
import org.springframework.web.util.UriComponentsBuilder;
3836

3937
import java.nio.charset.StandardCharsets;
4038
import java.text.MessageFormat;
@@ -61,7 +59,7 @@ public DefectDojoResponse<ToolType> getToolTypeByName(String name){
6159
RestTemplate restTemplate = new RestTemplate();
6260
HttpEntity toolTypeRequest = new HttpEntity(getHeaders());
6361

64-
String uri = UriComponentsBuilder.fromHttpUrl(defectDojoUrl + "/api/v2/tool_types/").queryParam("name", name).toUriString();
62+
String uri = defectDojoUrl + "/api/v2/tool_types/?name=" + name;
6563
ResponseEntity<DefectDojoResponse<ToolType>> toolTypeResponse = restTemplate.exchange(uri, HttpMethod.GET, toolTypeRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolType>>(){});
6664

6765
return toolTypeResponse.getBody();
@@ -85,7 +83,7 @@ public String getUserUrl(String username){
8583
username = "admin";
8684
}
8785

88-
String uri = UriComponentsBuilder.fromHttpUrl(defectDojoUrl + "/api/v2/users/").queryParam("username", username).toUriString();
86+
String uri = defectDojoUrl + "/api/v2/users/?username=" + username;
8987
HttpEntity userRequest = new HttpEntity(getHeaders());
9088
ResponseEntity<DefectDojoResponse<DefectDojoUser>> userResponse = restTemplate.exchange(uri, HttpMethod.GET, userRequest, new ParameterizedTypeReference<DefectDojoResponse<DefectDojoUser>>(){});
9189
if(userResponse.getBody().getCount() == 1){
@@ -96,22 +94,36 @@ public String getUserUrl(String username){
9694
}
9795
}
9896

97+
public String getProductUrl(String product){
98+
RestTemplate restTemplate = new RestTemplate();
99+
100+
String uri = defectDojoUrl + "/api/v2/products/?name=" + product;
101+
HttpEntity productRequest = new HttpEntity(getHeaders());
102+
ResponseEntity<DefectDojoResponse<DefectDojoProduct>> productResponse = restTemplate.exchange(uri, HttpMethod.GET, productRequest, new ParameterizedTypeReference<DefectDojoResponse<DefectDojoProduct>>(){});
103+
if(productResponse.getBody().getCount() == 1){
104+
return productResponse.getBody().getResults().get(0).getUrl();
105+
}
106+
else {
107+
throw new DefectDojoProductNotFound(MessageFormat.format("Could not find product: \"{0}\" in DefectDojo", product));
108+
}
109+
}
110+
99111
public String getToolConfiguration(String toolUrl, String toolType){
100112
RestTemplate restTemplate = new RestTemplate();
101113

102114
if (toolUrl == null){
103115
return null;
104116
}
105117

106-
String uri = UriComponentsBuilder.fromHttpUrl(defectDojoUrl + "/api/v2/tool_configurations/").queryParam("url", toolUrl).toUriString();
118+
String uri = defectDojoUrl + "/api/v2/tool_configurations/?url=" + toolUrl;
107119
HttpEntity toolRequest = new HttpEntity(getHeaders());
108120
ResponseEntity<DefectDojoResponse<ToolConfig>> toolResponse = restTemplate.exchange(uri, HttpMethod.GET, toolRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolConfig>>(){});
109121
if(toolResponse.getBody().getCount() > 0){
110122
return toolResponse.getBody().getResults().get(0).getUrl();
111123
}
112124
else {
113125
HttpEntity toolTypeRequest = new HttpEntity(getHeaders());
114-
String toolTypeRequestUri = UriComponentsBuilder.fromHttpUrl(defectDojoUrl + "/api/v2/tool_types/").queryParam("name", toolType).toUriString();
126+
String toolTypeRequestUri = defectDojoUrl + "/api/v2/tool_types/?name=" + toolType;
115127
ResponseEntity<DefectDojoResponse<ToolType>> toolTypeResponse = restTemplate.exchange(toolTypeRequestUri, HttpMethod.GET, toolTypeRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolType>>(){});
116128
String toolTypeUri = toolTypeResponse.getBody().getResults().get(0).getUrl();
117129

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/DefectDojoProduct.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package io.securecodebox.persistence.models;
2+
3+
import com.fasterxml.jackson.annotation.JsonProperty;
4+
5+
import java.util.List;
6+
import lombok.Data;
7+
8+
@Data
9+
public class DefectDojoProduct {
10+
@JsonProperty
11+
String url;
12+
13+
@JsonProperty
14+
String name;
15+
16+
@JsonProperty
17+
String description;
18+
19+
@JsonProperty("findings_count")
20+
int findingsCount;
21+
22+
@JsonProperty("authorized_users")
23+
List<String> authorizedUsers;
24+
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/EngagementPayload.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323

2424
import java.util.Arrays;
2525
import java.util.List;
26-
import java.util.Objects;
26+
2727

2828
@Data
2929
public class EngagementPayload {

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/test/java/io/securecodebox/persistence/DefectDojoPersistenceProviderTest.java‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,7 @@
55
import io.securecodebox.model.rest.Report;
66
import io.securecodebox.model.securitytest.CommonMetaFields;
77
import io.securecodebox.model.securitytest.SecurityTest;
8-
import io.securecodebox.persistence.models.DefectDojoResponse;
9-
import io.securecodebox.persistence.models.EngagementPayload;
10-
import io.securecodebox.persistence.models.EngagementResponse;
11-
import io.securecodebox.persistence.models.ToolType;
8+
import io.securecodebox.persistence.models.*;
129
import org.junit.Before;
1310
import org.junit.Test;
1411
import org.junit.runner.RunWith;
@@ -49,29 +46,30 @@ public void setUp() {
4946
when(descriptionGenerator.generate(any())).thenReturn("Foobar Description");
5047
doNothing().when(persistenceProvider).checkConnection();
5148

52-
persistenceProvider.defectDojoUrl = "http://localhost:8000";
5349
defectDojoService.defectDojoUrl = "http://localhost:8000";
5450

5551
DefectDojoResponse<ToolType> responseExisting = new DefectDojoResponse<>();
5652
responseExisting.setCount(1);
5753
when(defectDojoService.getToolTypeByName(any())).thenReturn(responseExisting);
5854

59-
EngagementResponse response = new EngagementResponse();
60-
response.setUrl("http://localhost:8000/api/v2/engagements/2/");
61-
when(defectDojoService.createEngagement(any())).thenReturn(response);
55+
EngagementResponse engagementResponse = new EngagementResponse();
56+
engagementResponse.setUrl("http://localhost:8000/api/v2/engagements/2/");
57+
when(defectDojoService.createEngagement(any())).thenReturn(engagementResponse);
58+
when(defectDojoService.getProductUrl("Nmap Scan 11")).thenReturn("http://localhost:8000/api/v2/products/1/");
59+
when(defectDojoService.getProductUrl("Nonexisting")).thenThrow(DefectDojoProductNotFound.class);
60+
6261

6362
metaData = new HashMap<>();
64-
metaData.put(DefectDojoMetaFields.DEFECT_DOJO_PRODUCT.name(), "1");
6563
metaData.put(DefectDojoMetaFields.DEFECT_DOJO_USER.name(), "John Doe");
6664
when(defectDojoService.getUserUrl(eq("John Doe"))).thenReturn("http://localhost:8000/api/v2/users/5/");
6765

6866
report = new Report();
6967
report.setRawFindings("\"[]\"");
7068
report.setFindings(Collections.emptyList());
7169

72-
when(defectDojoService.getToolConfiguration(eq("http://crazy.buildserver"), eq("BuildServer"))).thenReturn("http://localhost:8000/api/v2/tool_types/5/");
73-
when(defectDojoService.getToolConfiguration(eq("http://crazy.scm_server"), eq("GitServer"))).thenReturn("http://localhost:8000/api/v2/tool_types/7/");
74-
when(defectDojoService.getToolConfiguration(eq("https://github.com/secureCodeBox"), eq("SecurityTestOrchestrationEngine"))).thenReturn("http://localhost:8000/api/v2/tool_types/9/");
70+
when(defectDojoService.getToolConfiguration(eq("http://crazy.buildserver"), eq("Build Server"))).thenReturn("http://localhost:8000/api/v2/tool_types/5/");
71+
when(defectDojoService.getToolConfiguration(eq("http://crazy.scm_server"), eq("Git Server"))).thenReturn("http://localhost:8000/api/v2/tool_types/7/");
72+
when(defectDojoService.getToolConfiguration(eq("https://github.com/secureCodeBox"), eq("Security Test Orchestration Engine"))).thenReturn("http://localhost:8000/api/v2/tool_types/9/");
7573

7674
}
7775

@@ -83,17 +81,18 @@ public void createsANewToolTypeIfItCouldNotBeFound(){
8381

8482
DefectDojoResponse<ToolType> responseEmpty = new DefectDojoResponse<>();
8583
responseEmpty.setCount(0);
86-
when(defectDojoService.getToolTypeByName("GitServer")).thenReturn(responseEmpty);
84+
when(defectDojoService.getToolTypeByName("Git Server")).thenReturn(responseEmpty);
8785

8886
SecurityTest securityTest = new SecurityTest();
8987
securityTest.setReport(report);
9088
securityTest.setMetaData(metaData);
89+
securityTest.setName("nmap");
9190

9291
persistenceProvider.persist(securityTest);
9392

94-
verify(defectDojoService, times(1)).createToolType(eq("GitServer"), any());
95-
verify(defectDojoService, times(0)).createToolType(eq("BuildServer"), any());
96-
verify(defectDojoService, times(0)).createToolType(eq("SecurityTestOrchestrationEngine"), any());
93+
verify(defectDojoService, times(1)).createToolType(eq("Git Server"), any());
94+
verify(defectDojoService, times(0)).createToolType(eq("Build Server"), any());
95+
verify(defectDojoService, times(0)).createToolType(eq("Security Test Orchestration Engine"), any());
9796
}
9897

9998
@Test
@@ -105,6 +104,8 @@ public void doesntCreateAnyToolTypesIfAllAreAlreadyExisting(){
105104
SecurityTest securityTest = new SecurityTest();
106105
securityTest.setReport(report);
107106
securityTest.setMetaData(metaData);
107+
securityTest.setName("nmap");
108+
securityTest.setContext("Nmap Scan 11");
108109

109110
persistenceProvider.persist(securityTest);
110111

@@ -113,7 +114,6 @@ public void doesntCreateAnyToolTypesIfAllAreAlreadyExisting(){
113114

114115
@Test
115116
public void createsTheEngagement(){
116-
117117
SecurityTest securityTest = new SecurityTest();
118118
securityTest.setContext("Nmap Scan 11");
119119

@@ -123,10 +123,11 @@ public void createsTheEngagement(){
123123
metaData.put(CommonMetaFields.SCB_SCM_SERVER.name(), "http://crazy.scm_server");
124124
securityTest.setMetaData(metaData);
125125
securityTest.setReport(report);
126+
securityTest.setName("nmap");
126127

127128
EngagementPayload payload = new EngagementPayload();
128129
payload.setStatus(EngagementPayload.Status.COMPLETED);
129-
payload.setName("Nmap Scan 11");
130+
payload.setName("Nmap Scan");
130131
payload.setProduct("http://localhost:8000/api/v2/products/1/");
131132
payload.setLead("http://localhost:8000/api/v2/users/5/");
132133
payload.setBranch("master");
@@ -155,18 +156,19 @@ public void failsIfUserCouldNotBeFound(){
155156
metaData.put(DefectDojoMetaFields.DEFECT_DOJO_USER.name(), "This User really does not exist");
156157
securityTest.setMetaData(metaData);
157158
securityTest.setReport(report);
159+
securityTest.setName("nmap");
158160

159161
persistenceProvider.persist(securityTest);
160162
}
161163

162-
@Test(expected = DefectDojoProductNotProvided.class)
164+
@Test(expected = DefectDojoProductNotFound.class)
163165
public void failsIfProductCouldNotBeFound(){
164166
SecurityTest securityTest = new SecurityTest();
165-
securityTest.setContext("Nmap Scan 11");
167+
securityTest.setContext("Nonexisting");
166168

167-
metaData.remove(DefectDojoMetaFields.DEFECT_DOJO_PRODUCT.name());
168169
securityTest.setMetaData(metaData);
169170
securityTest.setReport(report);
171+
securityTest.setName("nmap");
170172

171173
persistenceProvider.persist(securityTest);
172174
}
@@ -186,6 +188,7 @@ public void createsFindings() throws JsonProcessingException {
186188
report.setRawFindings(doubleSer);
187189
securityTest.setMetaData(metaData);
188190
securityTest.setReport(report);
191+
securityTest.setName("nmap");
189192

190193
persistenceProvider.persist(securityTest);
191194
verify(defectDojoService, times(1)).createFindings(

‎scb-sdk/src/main/java/io/securecodebox/model/securitytest/CommonMetaFields.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@ public enum CommonMetaFields {
77
SCB_REPO,
88
SCB_TRACKER,
99
SCB_BUILD_SERVER,
10-
SCB_SCM_SERVER
10+
SCB_SCM_SERVER,
11+
SCB_ENGAGEMENT_TITLE
1112
}

0 commit comments

Comments
 (0)