Add new Persistence-Provider Hook to Import Scan Results into OWASP DefectDojo by J12934 · Pull Request #300 · secureCodeBox/secureCodeBox

J12934 · 2021-02-17T09:58:56Z

This PR adds a new Hook which imports raw results of scans into DefectDojo.
For more details check out the hooks readme: https://github.com/secureCodeBox/secureCodeBox/blob/feature/defect-dojo/hooks/persistence-defectdojo/README.md

You can test out this pr by using the official DefectDojo Demo instance at: https://demo.defectdojo.org/
See DefectDojo docs for the credentials: https://defectdojo.readthedocs.io/en/latest/

To test out the pr with the demo instance, you can install the hook like the following:

# check out secureCodeBox repo at feature/defect-dojo branch

# log in to defectdojo beforehand and grab the apiv2 key for your user. Then replace the apikey placeholder in the command below
kubectl create secret generic defectdojo-credentials --from-literal="username=admin" --from-literal="apikey=08b7..."

helm upgrade --install defectdojo-hook ./hooks/persistence-defectdojo/ \
  --set="defectdojo.url=https://demo.defectdojo.org" \
  --set="image.tag=feature-defect-dojo"

Product Names are infered by the Scans / ScheduledScans name, or if set by a special label.

- Optiimize Imports - Replace Getter/Setter with lombok - Remove unused methods

This lets us better control the fields of the test. E.g. the description and the timestamps

Encoding it again will mess with the signatures

J12934 · 2021-02-18T14:03:41Z

Ok, I got to say I'm a bit confused with code climate here.
The one method it doesn't like (getProductName) is probably one of the best readable ones in the PR.
Does anybody have an idea on how to improve it?

damiencarol · 2021-03-04T19:03:01Z

@J12934 I think it's because this method call a method of a proxy object. You should just remove it and use scan.getProductName() directly in your code.

  protected String getProductName(Scan scan) {
    if (scan.getProductName().isPresent()) {
      return scan.getProductName().get();
    }

Also there is a lot of loop and if statement that increase complexity. And I agree, 5 in complexity is a little bit low :D

rfelber · 2021-03-12T10:35:44Z

hooks/persistence-defectdojo/build.gradle

+dependencies {
+  implementation 'io.kubernetes:client-java:10.0.0'
+
+  implementation 'io.securecodebox:defectdojo-client:0.0.7-SNAPSHOT'


We should reference here a released version instead of a snapshot version.

Yes 👍
I planned to do this later after this initial merge once we're fairly certain that the API of the client is stable.

hooks/persistence-defectdojo/templates/_helpers.tpl

...dojo/src/main/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategy.java

damiencarol · 2021-04-13T16:37:25Z

@J12934 I saw that it's merged now! 👍
Do we have a demo env to test this one?

J12934 and others added 30 commits October 23, 2020 15:28

WIP port of the scb v1 DefectDojo integration

7a9445e

Add some missing attributes to the engagementPayload

4ea80f9

Support local development and execution of the hook

1670232

Fix typo

ec4787f

Properly name projectName

67f9506

Improve handling of Product names

dc8ec7b

Product Names are infered by the Scans / ScheduledScans name, or if set by a special label.

Regenerate README

2b668d9

Fix bug which lead dd pp to crash on its first run

f766c1b

Set new Engagements to "In Progress" by default

8550969

Extract testId after importing scan results

f32725d

Update DescriptionGenerator to generate usefull descriptions for v2

163df96

Throw proper error message when unable to fetch scan

91b61a2

Imporve error handling when ensuring proper tool types

1b5bb6a

Update DefectDojo mapping for scanner

3c1ecb9

Only create new engagements if they don't already exist

8861f23

Refactor product lookup

f326071

Delete unused import

7beef04

Update appVersion

38e0c3d

Copy over scb annotations from ScheduledScans to Scans

9c31908

Optimize Models

1d91aa9

- Optiimize Imports - Replace Getter/Setter with lombok - Remove unused methods

Switch to reimport and create test beforehand

49448f0

This lets us better control the fields of the test. E.g. the description and the timestamps

Updating Helm Docs

f034c50

Create configured Product and ProductTypes if they don't already exist

61fa566

Auto-format code

b031145

Slight refactoring

a7d3e5f

WIP Docs

6580ce5

WIP

135f192

Refactor DefectDojo persistence provider to generic service class

524f741

Update readme

26d7b82

Update sprint boot

9cbca1a

Don't url encode the download url for the file. It's already encoded...

6af1925

Encoding it again will mess with the signatures

J12934 and others added 2 commits March 5, 2021 16:48

Increase allowed method complexity

c0dc953

Merge branch 'main' into feature/defect-dojo

8bf647c

rfelber linked an issue Mar 7, 2021 that may be closed by this pull request

⚓️ New persistenceProvider Hook for OWASP DefectDojo #171

Closed

7 tasks

Merge branch 'main' into feature/defect-dojo

a8bb71f

rfelber reviewed Mar 12, 2021

View reviewed changes

Merge branch 'main' into feature/defect-dojo

fc8e10a

rfelber reviewed Mar 17, 2021

View reviewed changes

hooks/persistence-defectdojo/templates/_helpers.tpl Outdated Show resolved Hide resolved

J12934 and others added 5 commits March 18, 2021 14:26

Merge branch 'main' into feature/defect-dojo

1ef9e6c

Update template func names

1a52a60

Added some additional comments, fixed header and some compile issues.

cb8550f

Updating Helm Docs

b41c676

Fixing codeclimate issues.

30e858e

qlty-cloud-legacy bot reviewed Mar 18, 2021

View reviewed changes

...dojo/src/main/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategy.java Show resolved Hide resolved

Fixing codeclimate issues.

d7c1775

qlty-cloud-legacy bot reviewed Mar 18, 2021

View reviewed changes

...dojo/src/main/java/io/securecodebox/persistence/strategies/VersionedEngagementsStrategy.java Outdated Show resolved Hide resolved

rfelber added 2 commits March 18, 2021 19:04

Fixing codeclimate issues.

81de689

Fixing version.

1217db5

rfelber approved these changes Mar 18, 2021

View reviewed changes

rfelber added 2 commits March 18, 2021 23:32

Fixing productName strategie.

75caf61

Fixing productName strategie.

3b773b0

J12934 merged commit 0257dda into main Mar 19, 2021

J12934 deleted the feature/defect-dojo branch March 19, 2021 08:34

rfelber added this to the v2.6.0 milestone Mar 19, 2021

rfelber mentioned this pull request Mar 20, 2021

⚙️ Add a generic (SCB) finding importer to the DefectDojo Integration Hook #332

Closed

rfelber removed the enhancement New feature or request label Mar 26, 2021

rfelber changed the title ~~Add Hook to Import Scan Results into DefectDojo~~ Add new Persistence-Provider Hook to Import Scan Results into OWASP DefectDojo Mar 30, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Add new Persistence-Provider Hook to Import Scan Results into OWASP DefectDojo#300

Add new Persistence-Provider Hook to Import Scan Results into OWASP DefectDojo#300
J12934 merged 80 commits intomainfrom
feature/defect-dojo

J12934 commented Feb 17, 2021

Uh oh!

J12934 commented Feb 18, 2021

Uh oh!

damiencarol commented Mar 4, 2021 •

edited

Loading

Uh oh!

rfelber Mar 12, 2021 •

edited

Loading

Uh oh!

J12934 Mar 15, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

damiencarol commented Apr 13, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

J12934 commented Feb 17, 2021

Uh oh!

J12934 commented Feb 18, 2021

Uh oh!

damiencarol commented Mar 4, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfelber Mar 12, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

J12934 Mar 15, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

damiencarol commented Apr 13, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

damiencarol commented Mar 4, 2021 •

edited

Loading

rfelber Mar 12, 2021 •

edited

Loading