Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Commit 378161e

Browse files
MartinLang1MartinLang1
authored
Merge pull request #64 from secureCodeBox/bugfix/fixed-defect-dojo-get-tool-configuration
Adapted defect dojo persistence provider to defect dojo api changes
2 parents 61022ab + 397d41f commit 378161e

9 files changed

Lines changed: 95 additions & 75 deletions

File tree

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoPersistenceProvider.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -70,17 +70,17 @@ public void persist(SecurityTest securityTest) throws PersistenceException {
7070
checkToolTypes();
7171

7272
EngagementResponse res = createEngagement(securityTest);
73-
String engagementUrl = res.getUrl();
74-
LOG.debug("Created engagement: '{}'", engagementUrl);
73+
long engagementId = res.getId();
74+
LOG.debug("Created engagement: '{}'", engagementId);
7575

7676
String username = securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name());
77-
String userUrl = defectDojoService.getUserUrl(username);
77+
long userUrl = defectDojoService.retrieveUserId(username);
7878

7979
List<String> results = getDefectDojoScanName(securityTest.getName()).equals("Generic Findings Import") ? getGenericResults(securityTest) : getRawResults(securityTest);
8080
for (String result : results) {
8181
defectDojoService.createFindings(
8282
result,
83-
engagementUrl,
83+
engagementId,
8484
userUrl,
8585
currentDate(),
8686
getDefectDojoScanName(securityTest.getName())
@@ -157,25 +157,25 @@ private List<String> getGenericResults(SecurityTest securityTest) {
157157

158158
private EngagementResponse createEngagement(SecurityTest securityTest) {
159159
EngagementPayload engagementPayload = new EngagementPayload();
160-
engagementPayload.setProduct(defectDojoService.getProductUrl(securityTest.getContext()));
160+
engagementPayload.setProduct(defectDojoService.retrieveProductId(securityTest.getContext()));
161161

162162
if(securityTest.getMetaData() == null){
163163
securityTest.setMetaData(new HashMap<>());
164164
}
165165

166166
engagementPayload.setName(securityTest.getMetaData().get(CommonMetaFields.SCB_ENGAGEMENT_TITLE.name()) != null ?
167167
securityTest.getMetaData().get(CommonMetaFields.SCB_ENGAGEMENT_TITLE.name()) : getDefectDojoScanName(securityTest.getName()));
168-
engagementPayload.setLead(defectDojoService.getUserUrl(securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name())));
168+
engagementPayload.setLead(defectDojoService.retrieveUserId(securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name())));
169169
engagementPayload.setDescription(descriptionGenerator.generate(securityTest));
170170
engagementPayload.setBranch(securityTest.getMetaData().get(CommonMetaFields.SCB_BRANCH.name()));
171171
engagementPayload.setBuildID(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_ID.name()));
172172
engagementPayload.setCommitHash(securityTest.getMetaData().get(CommonMetaFields.SCB_COMMIT_HASH.name()));
173173
engagementPayload.setRepo(securityTest.getMetaData().get(CommonMetaFields.SCB_REPO.name()));
174174
engagementPayload.setTracker(securityTest.getMetaData().get(CommonMetaFields.SCB_TRACKER.name()));
175175

176-
engagementPayload.setBuildServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_SERVER.name()), BUILD_SERVER_NAME));
177-
engagementPayload.setScmServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_SCM_SERVER.name()), GIT_SERVER_NAME));
178-
engagementPayload.setOrchestrationEngine(defectDojoService.getToolConfiguration("https://github.com/secureCodeBox", SECURITY_TEST_SERVER_NAME));
176+
engagementPayload.setBuildServer(defectDojoService.retrieveOrCreateToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_SERVER.name()), BUILD_SERVER_NAME));
177+
engagementPayload.setScmServer(defectDojoService.retrieveOrCreateToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_SCM_SERVER.name()), GIT_SERVER_NAME));
178+
engagementPayload.setOrchestrationEngine(defectDojoService.retrieveOrCreateToolConfiguration("https://github.com/secureCodeBox", SECURITY_TEST_SERVER_NAME));
179179

180180
engagementPayload.setTargetStart(currentDate());
181181
engagementPayload.setTargetEnd(currentDate());

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java‎

Lines changed: 36 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ public void createToolType(String name, String description){
8282
restTemplate.exchange(defectDojoUrl + "/api/v2/tool_types/", HttpMethod.POST, toolPayload, ToolType.class);
8383
}
8484

85-
public String getUserUrl(String username){
85+
public Long retrieveUserId(String username){
8686
RestTemplate restTemplate = new RestTemplate();
8787

8888
if(username == null){
@@ -93,57 +93,66 @@ public String getUserUrl(String username){
9393
HttpEntity userRequest = new HttpEntity(getHeaders());
9494
ResponseEntity<DefectDojoResponse<DefectDojoUser>> userResponse = restTemplate.exchange(uri, HttpMethod.GET, userRequest, new ParameterizedTypeReference<DefectDojoResponse<DefectDojoUser>>(){});
9595
if(userResponse.getBody().getCount() == 1){
96-
return userResponse.getBody().getResults().get(0).getUrl();
96+
return userResponse.getBody().getResults().get(0).getId();
9797
}
9898
else {
9999
throw new DefectDojoUserNotFound(MessageFormat.format("Could not find user: \"{0}\" in DefectDojo", username));
100100
}
101101
}
102102

103-
public String getProductUrl(String product){
103+
public long retrieveProductId(String product){
104104
RestTemplate restTemplate = new RestTemplate();
105105

106106
String uri = defectDojoUrl + "/api/v2/products/?name=" + product;
107107
HttpEntity productRequest = new HttpEntity(getHeaders());
108108
ResponseEntity<DefectDojoResponse<DefectDojoProduct>> productResponse = restTemplate.exchange(uri, HttpMethod.GET, productRequest, new ParameterizedTypeReference<DefectDojoResponse<DefectDojoProduct>>(){});
109109
if(productResponse.getBody().getCount() == 1){
110-
return productResponse.getBody().getResults().get(0).getUrl();
110+
return productResponse.getBody().getResults().get(0).getId();
111111
}
112112
else {
113113
throw new DefectDojoProductNotFound(MessageFormat.format("Could not find product: \"{0}\" in DefectDojo", product));
114114
}
115115
}
116116

117-
public String getToolConfiguration(String toolUrl, String toolType){
118-
RestTemplate restTemplate = new RestTemplate();
119-
117+
public Long retrieveOrCreateToolConfiguration(String toolUrl, String toolType){
120118
if (toolUrl == null){
121119
return null;
122120
}
123121

124-
String uri = defectDojoUrl + "/api/v2/tool_configurations/?url=" + toolUrl;
125-
HttpEntity toolRequest = new HttpEntity(getHeaders());
126-
ResponseEntity<DefectDojoResponse<ToolConfig>> toolResponse = restTemplate.exchange(uri, HttpMethod.GET, toolRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolConfig>>(){});
122+
ResponseEntity<DefectDojoResponse<ToolConfig>> toolResponse = retrieveToolConfiguration(toolUrl);
127123
if(toolResponse.getBody().getCount() > 0){
128-
return toolResponse.getBody().getResults().get(0).getUrl();
124+
LOG.info("Tool configuration already exists. Returning existing configuration.");
125+
return toolResponse.getBody().getResults().get(0).getId();
129126
}
130127
else {
131-
HttpEntity toolTypeRequest = new HttpEntity(getHeaders());
132-
String toolTypeRequestUri = defectDojoUrl + "/api/v2/tool_types/?name=" + toolType;
133-
ResponseEntity<DefectDojoResponse<ToolType>> toolTypeResponse = restTemplate.exchange(toolTypeRequestUri, HttpMethod.GET, toolTypeRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolType>>(){});
134-
String toolTypeUri = toolTypeResponse.getBody().getResults().get(0).getUrl();
128+
LOG.info("Tool configuration does not exist yet. Creating new configuration.");
129+
createToolConfiguration(toolUrl, toolType);
130+
return retrieveToolConfiguration(toolUrl).getBody().getResults().get(0).getId();
131+
}
132+
}
133+
134+
private ResponseEntity<DefectDojoResponse<ToolConfig>> retrieveToolConfiguration(String toolUrl) {
135+
RestTemplate restTemplate = new RestTemplate();
136+
String uri = defectDojoUrl + "/api/v2/tool_configurations/?name=" + toolUrl;
137+
HttpEntity toolRequest = new HttpEntity(getHeaders());
138+
return restTemplate.exchange(uri, HttpMethod.GET, toolRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolConfig>>(){});
139+
}
135140

136-
ToolConfig toolConfig = new ToolConfig();
137-
toolConfig.setName(toolUrl);
138-
toolConfig.setToolType(toolTypeUri);
139-
toolConfig.setConfigUrl(toolUrl);
140-
toolConfig.setDescription(toolType);
141+
private void createToolConfiguration(String toolUrl, String toolType) {
142+
HttpEntity toolTypeRequest = new HttpEntity(getHeaders());
143+
String toolTypeRequestUri = defectDojoUrl + "/api/v2/tool_types/?name=" + toolType;
144+
RestTemplate restTemplate = new RestTemplate();
145+
ResponseEntity<DefectDojoResponse<ToolType>> toolTypeResponse = restTemplate.exchange(toolTypeRequestUri, HttpMethod.GET, toolTypeRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolType>>(){});
146+
String toolTypeId = toolTypeResponse.getBody().getResults().get(0).getId();
141147

142-
HttpEntity<ToolConfig> toolPayload = new HttpEntity<>(toolConfig, getHeaders());
143-
restTemplate.exchange(defectDojoUrl + "/api/v2/tool_configurations/", HttpMethod.POST, toolPayload, ToolConfig.class);
144-
return getToolConfiguration(toolUrl, toolType);
148+
ToolConfig toolConfig = new ToolConfig();
149+
toolConfig.setName(toolUrl);
150+
toolConfig.setToolType(toolTypeId);
151+
toolConfig.setConfigUrl(toolUrl);
152+
toolConfig.setDescription(toolType);
145153

146-
}
154+
HttpEntity<ToolConfig> toolPayload = new HttpEntity<>(toolConfig, getHeaders());
155+
restTemplate.exchange(defectDojoUrl + "/api/v2/tool_configurations/", HttpMethod.POST, toolPayload, ToolConfig.class);
147156
}
148157

149158
public EngagementResponse createEngagement(EngagementPayload engagementPayload) {
@@ -161,15 +170,15 @@ public EngagementResponse createEngagement(EngagementPayload engagementPayload)
161170
}
162171
}
163172

164-
public ImportScanResponse createFindings(String rawResult, String engagementUrl, String lead, String currentDate,String defectDojoScanName) {
173+
public ImportScanResponse createFindings(String rawResult, long engagementId, long lead, String currentDate,String defectDojoScanName) {
165174
RestTemplate restTemplate = new RestTemplate();
166175
HttpHeaders headers = getHeaders();
167176
headers.setContentType(MediaType.MULTIPART_FORM_DATA);
168177
restTemplate.setMessageConverters(Arrays.asList(new FormHttpMessageConverter(), new ResourceHttpMessageConverter(), new MappingJackson2HttpMessageConverter()));
169178

170179
MultiValueMap<String, Object> mvn = new LinkedMultiValueMap<>();
171-
mvn.add("engagement", engagementUrl);
172-
mvn.add("lead", lead);
180+
mvn.add("engagement", Long.toString(engagementId));
181+
mvn.add("lead", Long.toString(lead));
173182
mvn.add("scan_date", currentDate);
174183
mvn.add("scan_type", defectDojoScanName);
175184

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/DefectDojoProduct.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
@Data
99
public class DefectDojoProduct {
1010
@JsonProperty
11-
String url;
11+
long id;
1212

1313
@JsonProperty
1414
String name;

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/DefectDojoUser.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
public class DefectDojoUser {
66
@JsonProperty
7-
String url;
7+
Long id;
88

99
@JsonProperty
1010
String username;
@@ -15,12 +15,12 @@ public class DefectDojoUser {
1515
@JsonProperty("last_name")
1616
String lastName;
1717

18-
public String getUrl() {
19-
return url;
18+
public Long getId() {
19+
return id;
2020
}
2121

22-
public void setUrl(String url) {
23-
this.url = url;
22+
public void setId(Long id) {
23+
this.id = id;
2424
}
2525

2626
public String getUsername() {

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/EngagementPayload.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public class EngagementPayload {
3131
protected String name;
3232

3333
@JsonProperty
34-
protected String product;
34+
protected long product;
3535

3636
@JsonProperty("target_start")
3737
protected String targetStart;
@@ -40,7 +40,7 @@ public class EngagementPayload {
4040
protected String targetEnd;
4141

4242
@JsonProperty
43-
protected String lead;
43+
protected Long lead;
4444

4545
@JsonProperty("engagement_type")
4646
protected String engagementType = "CI/CD";
@@ -67,13 +67,13 @@ public class EngagementPayload {
6767
protected String repo;
6868

6969
@JsonProperty("build_server")
70-
protected String buildServer;
70+
protected Long buildServer;
7171

7272
@JsonProperty("source_code_management_server")
73-
protected String scmServer;
73+
protected Long scmServer;
7474

7575
@JsonProperty("orchestration_engine")
76-
protected String orchestrationEngine;
76+
protected Long orchestrationEngine;
7777

7878
@JsonProperty
7979
protected String description;

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/EngagementResponse.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@
2222

2323
public class EngagementResponse {
2424
@JsonProperty
25-
protected String url;
25+
protected long id;
2626

27-
public String getUrl() {
28-
return url;
27+
public long getId() {
28+
return id;
2929
}
3030

31-
public void setUrl(String url) {
32-
this.url = url;
31+
public void setId(long id) {
32+
this.id = id;
3333
}
3434
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/ToolConfig.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
import com.fasterxml.jackson.annotation.JsonProperty;
44

55
public class ToolConfig {
6+
@JsonProperty
7+
long id;
8+
69
@JsonProperty
710
String url;
811

@@ -18,6 +21,14 @@ public class ToolConfig {
1821
@JsonProperty
1922
String description;
2023

24+
public long getId() {
25+
return id;
26+
}
27+
28+
public void setId(long id) {
29+
this.id = id;
30+
}
31+
2132
public String getDescription() {
2233
return description;
2334
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/ToolType.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,20 @@
44

55
public class ToolType {
66
@JsonProperty
7-
String url;
7+
String id;
88

99
@JsonProperty
1010
String name;
1111

1212
@JsonProperty
1313
String description;
1414

15-
public String getUrl() {
16-
return url;
15+
public String getId() {
16+
return id;
1717
}
1818

19-
public void setUrl(String url) {
20-
this.url = url;
19+
public void setId(String id) {
20+
this.id = id;
2121
}
2222

2323
public String getName() {

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/test/java/io/securecodebox/persistence/DefectDojoPersistenceProviderTest.java‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -55,23 +55,23 @@ public void setUp() {
5555
when(defectDojoService.getToolTypeByName(any())).thenReturn(responseExisting);
5656

5757
EngagementResponse engagementResponse = new EngagementResponse();
58-
engagementResponse.setUrl("http://localhost:8000/api/v2/engagements/2/");
58+
engagementResponse.setId(2);
5959
when(defectDojoService.createEngagement(any())).thenReturn(engagementResponse);
60-
when(defectDojoService.getProductUrl("Nmap Scan 11")).thenReturn("http://localhost:8000/api/v2/products/1/");
61-
when(defectDojoService.getProductUrl("Nonexisting")).thenThrow(DefectDojoProductNotFound.class);
60+
when(defectDojoService.retrieveProductId("Nmap Scan 11")).thenReturn(1l);
61+
when(defectDojoService.retrieveProductId("Nonexisting")).thenThrow(DefectDojoProductNotFound.class);
6262

6363

6464
metaData = new HashMap<>();
6565
metaData.put(DefectDojoMetaFields.DEFECT_DOJO_USER.name(), "John Doe");
66-
when(defectDojoService.getUserUrl(eq("John Doe"))).thenReturn("http://localhost:8000/api/v2/users/5/");
66+
when(defectDojoService.retrieveUserId(eq("John Doe"))).thenReturn(5l);
6767

6868
report = new Report();
6969
report.setRawFindings("\"[]\"");
7070
report.setFindings(Collections.emptyList());
7171

72-
when(defectDojoService.getToolConfiguration(eq("http://crazy.buildserver"), eq("Build Server"))).thenReturn("http://localhost:8000/api/v2/tool_types/5/");
73-
when(defectDojoService.getToolConfiguration(eq("http://crazy.scm_server"), eq("Git Server"))).thenReturn("http://localhost:8000/api/v2/tool_types/7/");
74-
when(defectDojoService.getToolConfiguration(eq("https://github.com/secureCodeBox"), eq("Security Test Orchestration Engine"))).thenReturn("http://localhost:8000/api/v2/tool_types/9/");
72+
when(defectDojoService.retrieveOrCreateToolConfiguration(eq("http://crazy.buildserver"), eq("Build Server"))).thenReturn(5l);
73+
when(defectDojoService.retrieveOrCreateToolConfiguration(eq("http://crazy.scm_server"), eq("Git Server"))).thenReturn(7l);
74+
when(defectDojoService.retrieveOrCreateToolConfiguration(eq("https://github.com/secureCodeBox"), eq("Security Test Orchestration Engine"))).thenReturn(9l);
7575

7676
}
7777

@@ -130,16 +130,16 @@ public void createsTheEngagement(){
130130
EngagementPayload payload = new EngagementPayload();
131131
payload.setStatus(EngagementPayload.Status.COMPLETED);
132132
payload.setName("Nmap Scan");
133-
payload.setProduct("http://localhost:8000/api/v2/products/1/");
134-
payload.setLead("http://localhost:8000/api/v2/users/5/");
133+
payload.setProduct(1l);
134+
payload.setLead(5l);
135135
payload.setBranch("master");
136136
payload.setRepo("https://github.com/secureCodeBox/engine");
137137
payload.setDescription("Foobar Description");
138138
payload.setTargetStart("2019-01-07");
139139
payload.setTargetEnd("2019-01-07");
140-
payload.setBuildServer("http://localhost:8000/api/v2/tool_types/5/");
141-
payload.setScmServer("http://localhost:8000/api/v2/tool_types/7/");
142-
payload.setOrchestrationEngine("http://localhost:8000/api/v2/tool_types/9/");
140+
payload.setBuildServer(5l);
141+
payload.setScmServer(7l);
142+
payload.setOrchestrationEngine(9l);
143143

144144
persistenceProvider.persist(securityTest);
145145

@@ -150,7 +150,7 @@ public void createsTheEngagement(){
150150

151151
@Test(expected = DefectDojoUserNotFound.class)
152152
public void failsIfUserCouldNotBeFound(){
153-
when(defectDojoService.getUserUrl(any())).thenThrow(new DefectDojoUserNotFound(""));
153+
when(defectDojoService.retrieveUserId(any())).thenThrow(new DefectDojoUserNotFound(""));
154154

155155
SecurityTest securityTest = new SecurityTest();
156156
securityTest.setContext("Nmap Scan 11");
@@ -195,8 +195,8 @@ public void createsFindingsForSupportedScanner() throws JsonProcessingException
195195
persistenceProvider.persist(securityTest);
196196
verify(defectDojoService, times(1)).createFindings(
197197
eq("<Some Xml stuff>\n<Don't know how the form is>"),
198-
eq("http://localhost:8000/api/v2/engagements/2/"),
199-
eq("http://localhost:8000/api/v2/users/5/"),
198+
eq(2l),
199+
eq(5l),
200200
eq("2019-01-07"),
201201
eq("Nmap Scan")
202202
);
@@ -225,10 +225,10 @@ public void createsFindingsForNonSupportedScanner() {
225225
verify(defectDojoService, times(1)).createFindings(
226226
eq( "date,title,cweid,url,severity,description,mitigation,impact,references,active,verified,falsepositive,duplicate\n"+
227227
"2019-01-07,findingname,,http://someadress,INFORMATIONAL,description,,,,,,false,false"),
228-
eq("http://localhost:8000/api/v2/engagements/2/"),
229-
eq("http://localhost:8000/api/v2/users/5/"),
228+
eq(2l),
229+
eq(5l),
230230
eq("2019-01-07"),
231231
eq("Generic Findings Import")
232232
);
233233
}
234-
}
234+
}

0 commit comments

Comments
 (0)