Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Commit 5d039fa

Browse files
J12934J12934
committed
Merge remote-tracking branch 'origin/feature/defect-dojo-generic-import' into merge/defect-dojo
# Conflicts: # scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoPersistenceProvider.java # scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java
2 parents 2b331a2 + 504ec34 commit 5d039fa

File tree

5 files changed

+77
-17
lines changed

5 files changed

+77
-17
lines changed

‎scb-engine/pom.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,12 @@
166166
<version>0.0.1-SNAPSHOT</version>
167167
<scope>runtime</scope>
168168
</dependency>
169+
<dependency>
170+
<groupId>io.securecodebox.scanprocesses</groupId>
171+
<artifactId>subdomain-scanner-process</artifactId>
172+
<version>1.0-SNAPSHOT</version>
173+
<scope>runtime</scope>
174+
</dependency>
169175
<dependency>
170176
<groupId>io.securecodebox.scanprocesses</groupId>
171177
<artifactId>combined-nmap-nikto-scanprocess</artifactId>

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoPersistenceProvider.java‎

Lines changed: 36 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
package io.securecodebox.persistence;
2020

2121
import com.fasterxml.jackson.databind.ObjectMapper;
22+
import io.securecodebox.model.findings.Finding;
2223
import io.securecodebox.model.securitytest.CommonMetaFields;
2324
import io.securecodebox.model.securitytest.SecurityTest;
2425

@@ -33,6 +34,7 @@
3334
import java.net.MalformedURLException;
3435
import java.net.URL;
3536
import java.net.URLConnection;
37+
import java.text.MessageFormat;
3638
import java.time.Clock;
3739
import java.time.LocalDate;
3840
import java.time.format.DateTimeFormatter;
@@ -72,20 +74,21 @@ public void persist(SecurityTest securityTest) throws PersistenceException {
7274
String username = securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name());
7375
String userUrl = defectDojoService.getUserUrl(username);
7476

75-
for (String rawResult : getRawResults(securityTest)) {
76-
defectDojoService.createFindings(
77-
rawResult,
78-
engagementUrl,
79-
userUrl,
80-
currentDate(),
81-
getDefectDojoScanName(securityTest.getName())
82-
);
83-
}
77+
List<String> results = getDefectDojoScanName(securityTest.getName()).equals("Generic Findings Import") ? getGenericResults(securityTest) : getRawResults(securityTest);
78+
for (String result : results) {
79+
defectDojoService.createFindings(
80+
result,
81+
engagementUrl,
82+
userUrl,
83+
currentDate(),
84+
getDefectDojoScanName(securityTest.getName())
85+
);
86+
}
8487
}
8588

86-
static final String GIT_SERVER_NAME = "Git Server";
87-
static final String BUILD_SERVER_NAME = "Build Server";
88-
static final String SECURITY_TEST_SERVER_NAME = "Security Test Orchestration Engine";
89+
static final String GIT_SERVER_NAME = "GitServer";
90+
static final String BUILD_SERVER_NAME = "BuildServer";
91+
static final String SECURITY_TEST_SERVER_NAME = "SecurityTestOrchestrationEngine";
8992

9093
private void checkToolTypes() {
9194
DefectDojoResponse<ToolType> toolTypeGitResponse = defectDojoService.getToolTypeByName(GIT_SERVER_NAME);
@@ -128,6 +131,23 @@ private List<String> getRawResults(SecurityTest securityTest) throws DefectDojoP
128131
}
129132
}
130133

134+
private List<String> getGenericResults(SecurityTest securityTest) {
135+
List<String> genericResults = new LinkedList<>();
136+
for(Finding finding: securityTest.getReport().getFindings()){
137+
genericResults.add(MessageFormat.format("date,title,cweid,url,severity,description,mitigation,impact,references,active,verified,falsepositive,duplicate\n" +
138+
"{0},{1},,{2},{3},{4},,,,,,{5},{6}",
139+
currentDate(),
140+
finding.getName().replace(",", " "),
141+
finding.getLocation().replace(",", " "),
142+
finding.getSeverity(),
143+
finding.getDescription().replace(",", " "),
144+
finding.isFalsePositive(),
145+
"false"
146+
));
147+
}
148+
return genericResults;
149+
}
150+
131151
private EngagementResponse createEngagement(SecurityTest securityTest) {
132152
EngagementPayload engagementPayload = new EngagementPayload();
133153
engagementPayload.setProduct(defectDojoService.getProductUrl(securityTest.getContext()));
@@ -169,7 +189,8 @@ protected static String getDefectDojoScanName(String securityTestName) {
169189
scannerDefectDojoMapping.put("nmap", "Nmap Scan");
170190
scannerDefectDojoMapping.put("zap", "ZAP Scan");
171191

172-
// TODO: Why is nikto not in the list?
192+
// Nikto is a supported tool as well but currently not accessible for supported import.
193+
// Nikto thus will use Generic Findings Import.
173194

174195
// Can be used by 3rd party integrations to
175196
// import these scan results directly into defectdojo
@@ -195,8 +216,8 @@ protected static String getDefectDojoScanName(String securityTestName) {
195216

196217
if (scannerDefectDojoMapping.containsKey(securityTestName)) {
197218
return scannerDefectDojoMapping.get(securityTestName);
219+
}else{
220+
return "Generic Findings Import";
198221
}
199-
200-
throw new DefectDojoPersistenceException("No defectdojo parser for securityTest: '" + securityTestName + "'");
201222
}
202223
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
*/
1919
package io.securecodebox.persistence;
2020

21+
2122
import io.securecodebox.persistence.models.*;
2223
import org.slf4j.Logger;
2324
import org.slf4j.LoggerFactory;

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/test/java/io/securecodebox/persistence/DefectDojoPersistenceProviderTest.java‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import com.fasterxml.jackson.core.JsonProcessingException;
44
import com.fasterxml.jackson.databind.ObjectMapper;
5+
import io.securecodebox.model.findings.Finding;
56
import io.securecodebox.model.rest.Report;
67
import io.securecodebox.model.securitytest.CommonMetaFields;
78
import io.securecodebox.model.securitytest.SecurityTest;
@@ -19,6 +20,7 @@
1920
import java.time.ZoneId;
2021
import java.util.*;
2122

23+
import static io.securecodebox.model.findings.Severity.INFORMATIONAL;
2224
import static org.mockito.Matchers.any;
2325
import static org.mockito.Matchers.eq;
2426
import static org.mockito.Mockito.*;
@@ -174,7 +176,7 @@ public void failsIfProductCouldNotBeFound(){
174176
}
175177

176178
@Test
177-
public void createsFindings() throws JsonProcessingException {
179+
public void createsFindingsForSupportedScanner() throws JsonProcessingException {
178180
SecurityTest securityTest = new SecurityTest();
179181
securityTest.setContext("Nmap Scan 11");
180182
securityTest.setName("nmap");
@@ -199,4 +201,34 @@ public void createsFindings() throws JsonProcessingException {
199201
eq("Nmap Scan")
200202
);
201203
}
204+
205+
@Test
206+
public void createsFindingsForNonSupportedScanner() {
207+
SecurityTest securityTest = new SecurityTest();
208+
securityTest.setContext("Non supported Scan 11");
209+
securityTest.setName("any non supported scanner");
210+
211+
List<Finding> findings = new ArrayList<>();
212+
Finding finding = new Finding();
213+
finding.setName("findingname");
214+
finding.setDescription("description");
215+
finding.setFalsePositive(false);
216+
finding.setLocation("http://someadress");
217+
finding.setSeverity(INFORMATIONAL);
218+
findings.add(finding);
219+
220+
report.setFindings(findings);
221+
securityTest.setMetaData(metaData);
222+
securityTest.setReport(report);
223+
224+
persistenceProvider.persist(securityTest);
225+
verify(defectDojoService, times(1)).createFindings(
226+
eq( "date,title,cweid,url,severity,description,mitigation,impact,references,active,verified,falsepositive,duplicate\n"+
227+
"2019-01-07,findingname,,http://someadress,INFORMATIONAL,description,,,,,,false,false"),
228+
eq("http://localhost:8000/api/v2/engagements/2/"),
229+
eq("http://localhost:8000/api/v2/users/5/"),
230+
eq("2019-01-07"),
231+
eq("Generic Findings Import")
232+
);
233+
}
202234
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/test/java/io/securecodebox/persistence/DescriptionGeneratorTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public void generate(){
3737
public void nullGenerate(){
3838
securityTest.setTarget(new Target());
3939

40-
assertEquals("#null \nTime: 07.01.2019 16:50:03 \nTarget: null \"null\"", descriptionGenerator.generate(securityTest));
40+
assertEquals("#Generic Findings Import \nTime: 07.01.2019 16:50:03 \nTarget: null \"null\"", descriptionGenerator.generate(securityTest));
4141
}
4242

4343
}

0 commit comments

Comments
 (0)