secureCodeBox · J12934 · Mar 19, 2021 · Oct 23, 2020 · Oct 23, 2020 · Oct 23, 2020
diff --git a/.codeclimate.yml b/.codeclimate.yml
@@ -1,4 +1,4 @@
-version: "2"         # required to adjust maintainability checks
+version: "2" # required to adjust maintainability checks
 checks:
   file-lines:
     config:
@@ -10,6 +10,20 @@ checks:
     enabled: false
   identical-code:
     enabled: false
+# plugins:
+#   eslint:
+#     enabled: true
+#     channel: "eslint-7"
+#   fixme:
+#     enabled: true
+#   golint:
+#     enabled: true
+#   gofmt:
+#     enabled: true
+#   govet:
+#     enabled: true
+#   markdownlint:
+#     enabled: true
 exclude_patterns:
   - "config/"
   - "db/"
@@ -27,4 +41,6 @@ exclude_patterns:
   - "**/*_test.go"
   - "**/*.deepcopy.go"
   - "**/*.test.js"
-  - "**/*.d.ts"
+  - "**/*.d.ts"
+  # Auto Generated by kubernetes java client
+  - "**/hooks/persistence-defectdojo/src/main/java/io/securecodebox/models/"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -14,6 +14,25 @@ env:
 
 jobs:
   # ---- Unit-Test ----
+
+  # ---- Unit-Test | Java ----
+
+  unit-java:
+    name: "Unit-Test | Java"
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        unit: ["persistence-defectdojo"]
+    steps:
+    - uses: actions/checkout@v2
+    - uses: actions/setup-java@v1
+      with:
+        java-version: '11' # The JDK version to make available on the path.
+        java-package: jdk # (jre, jdk, or jdk+fx) - defaults to jdk
+        architecture: x64 # (x64 or x86) - defaults to x64
+    - run: |
+        cd hooks/${{ matrix.unit }}/
+        ./gradlew test
 
   # ---- Unit-Test | Python ----
 
@@ -209,6 +228,7 @@ jobs:
           - finding-post-processing
           - generic-webhook
           - persistence-elastic
+          - persistence-defectdojo
           - update-field
           - teams-webhook
     steps:

diff --git a/hooks/persistence-defectdojo/.dockerignore b/hooks/persistence-defectdojo/.dockerignore
@@ -0,0 +1,7 @@
+Dockerfile
+./gradle
+./idea
+./settings
+build/
+gradle/
+templates
diff --git a/hooks/persistence-defectdojo/.gitignore b/hooks/persistence-defectdojo/.gitignore
@@ -0,0 +1,35 @@
+HELP.md
+.gradle
+build/
+bin/
+!gradle/wrapper/gradle-wrapper.jar
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+out/
+!**/src/main/**/out/
+!**/src/test/**/out/
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+
+### VS Code ###
+.vscode/
diff --git a/hooks/persistence-defectdojo/.helmignore b/hooks/persistence-defectdojo/.helmignore
@@ -0,0 +1,38 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# Node.js files
+node_modules/*
+package.json
+package-lock.json
+src/*
+config/*
+Dockerfile
+.dockerignore
+gradle/
+.gradle/
+src/
+gradlew
+gradlew.bat
+settings.gradle
+update.sh
+build/
diff --git a/hooks/persistence-defectdojo/Chart.yaml b/hooks/persistence-defectdojo/Chart.yaml
@@ -0,0 +1,13 @@
+apiVersion: v2
+name: persistence-defectdojo
+description: The defectdojo persistence provider persists secureCodeBox scan results into defectdojo.
+
+type: application
+
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: v2.6.0-alpha1
+
+appVersion: 1.12.0
+kubeVersion: ">=v1.11.0-0"
+
+dependencies: []
diff --git a/hooks/persistence-defectdojo/Dockerfile b/hooks/persistence-defectdojo/Dockerfile
@@ -0,0 +1,9 @@
+FROM gradle:jdk11 as build
+COPY . /home/gradle/src
+WORKDIR /home/gradle/src
+RUN gradle build -x test
+
+FROM gcr.io/distroless/java:11-nonroot
+COPY --from=build --chown=nonroot:nonroot /home/gradle/src/build/libs /app
+# TLS Config works around an issue in OpenJDK... See: https://github.com/kubernetes-client/java/issues/854
+ENTRYPOINT ["java", "-Djdk.tls.client.protocols=TLSv1.2", "-jar", "/app/defectdojo-persistenceprovider-0.1.0-SNAPSHOT.jar"]
diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md
@@ -2,24 +2,116 @@
 title: "DefectDojo"
 category: "hook"
 type: "persistenceProvider"
-state: "developing"
-usecase: "Publishes all Scan Findings to DefectDojo."
+state: "released"
+usecase: "Publishes all Scan Reports to OWASP DefectDojo."
 ---
 
-<!-- end -->
-
 ## About
 
-DefectDojo is an open-source tool for importing and managing findings of security scanners. The DefectDojo persistence provider can be used to create new Engagements for SecurityTests run via the secureCodeBox and import all findings which were identified automatically to DefectDojo.
+The DefectDojo hook imports the reports from scans automatically into [OWASP DefectDojo](https://www.defectdojo.org/).
+The hook uses the import scan [API from DefectDojo](https://defectdojo.readthedocs.io/en/latest/api-v2-docs.html) to import the scan results.
+
+This means that only scan types are supported by the hook which are both supported by the secureCodeBox and DefectDojo.
+These are:
+- Nmap
+- ZAP (Baseline, API Scan and Full Scan)
+- SSLyze
+- Trivy
+- Gitleaks
+
+:::caution
+
+Nikto is currently **not** supported even though it's supported by the secureCodeBox and DefectDojo as the secureCodeBox
+uses the Nikto JSON format while DefectDojo uses the XML format.
+
+:::
+
+## Runtime Configuration
+
+The hook will automatically import the scan results into an engagement in DefectDojo.
+If the engagement doesn't exist the hook will create the engagement (CI/CD engagement) and all objects required for it
+(product & product type).
+
+You don't need any configuration for that to work, the hook will infer engagement & product names from the scan name.
+If you want more control over the names or add additional meta information like the version of the tested software you
+can add these via annotation to the scan. See examples below.
 
-Tools which are supported both by the secureCodeBox and DefectDojo (OWASP ZAP & Nmap) this is done by importing the raw scan report into DefectDojo. Findings by other secureCodeBox supported scanners are currently not directly supported by DefectDojo. These findings are imported via a generic finding API of DefectDojo, which might cause some loss of information on the findings.  
+| Scan Annotation                                  | Description                | Default if not set                                                   | Notes                                                                                 |
+|--------------------------------------------------|----------------------------|----------------------------------------------------------------------|---------------------------------------------------------------------------------------|
+| `defectdojo.securecodebox.io/product-type-name`  | Name of the Product Type   | Product Type with ID 1 (typically "Research and Development")        | Product Type will be automatically created if no Product Type under that name exists  |
+| `defectdojo.securecodebox.io/product-name`       | Name of the Product        | ScheduledScan Name if Scheduled, Scan Name if it's a standalone Scan | Product  will be automatically created if no Product under that name exists           |
+| `defectdojo.securecodebox.io/product-description`| Description of the Product | Empty String                                                         | Only used when creating the Product not used for updating                             |
+| `defectdojo.securecodebox.io/product-tags`       | Product Tags               | Nothing                                                              | Only used when creating the Product not used for updating                             |
+| `defectdojo.securecodebox.io/engagement-name`    | Name of the Engagement     | Scan Name                                                            | Will be automatically created if not Engagement with that name **and** version exists |
+| `defectdojo.securecodebox.io/engagement-version` | Engagement Version         | Nothing                                                              |                                                                                       |
+| `defectdojo.securecodebox.io/engagement-tags`    | Engagement Tags            | Nothing                                                              | Only used when creating the Product not used for updating                             |
 
-To learn more about DefectDojo visit [DefectDojo GitHub] or [DefectDojo Website].
+### Simple Example Scans
+
+This will import the results daily into an engagements called: "zap-juiceshop-$UNIX_TIMESTAMP" (Name of the Scan created daily by the ScheduledScan), in a Product called: "zap-juiceshop" in the default DefectDojo product type.
+
+```yaml
+apiVersion: "execution.securecodebox.io/v1"
+kind: ScheduledScan
+metadata:
+  name: "zap-juiceshop"
+spec:
+  interval: 24h
+  scanSpec:
+    scanType: "zap-full-scan"
+    parameters:
+      - "-t"
+      - "http://juice-shop.demo-apps.svc:3000"
+```
+
+### Complete Example Scan
+
+This will import the results into engagement, product and product type following the labels.
+The engagement will be reused by the hook for the daily scans / imports until the engagement version is increased.
+
+```yaml
+apiVersion: "execution.securecodebox.io/v1"
+kind: ScheduledScan
+metadata:
+  name: "zap-full-scan-juiceshop"
+  annotations:
+    defectdojo.securecodebox.io/product-type-name: "OWASP"
+    defectdojo.securecodebox.io/product-name: "Juice Shop"
+    defectdojo.securecodebox.io/product-description: |
+      OWASP Juice Shop is probably the most modern and sophisticated insecure web application!
+      It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools!
+      Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!
+    defectdojo.securecodebox.io/product-tags: vulnerable,appsec,owasp-top-ten,vulnapp
+    defectdojo.securecodebox.io/engagement-name: "Juice Shop"
+    defectdojo.securecodebox.io/engagement-version: "v12.6.1"
+    defectdojo.securecodebox.io/engagement-tags: "automated,daily"
+spec:
+  interval: 24h
+  scanSpec:
+    scanType: "zap-full-scan"
+    parameters:
+      - "-t"
+      - "http://juice-shop.demo-apps.svc:3000"
+```
 
 ## Deployment
-> 🔧 The implementation is currently work-in-progress and under still undergoing major changes. It'll be released here once it has stabilized.
 
+Installing the DefectDojo persistenceProvider hook will add a _ReadOnly Hook_ to your namespace.
+
+```bash
+kubectl create secret generic defectdojo-credentials --from-literal="username=admin" --from-literal="apikey=08b7..."
+
+helm upgrade --install dd secureCodeBox/persistence-defectdojo \
+    --set="defectdojo.url=https://defectdojo-django.default.svc"
+```
+
+## Chart Configuration
 
-[DefectDojo Website]: https://www.defectdojo.org/
-[DefectDojo GitHub]: https://github.com/DefectDojo/django-DefectDojo
-[DefectDojo Documentation]: https://defectdojo.readthedocs.io/en/latest/
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| defectdojo.authentication.apiKeyKey | string | `"apikey"` | Name of the apikey key in the `userSecret` secret. Use this if you already have a secret with different key / value pairs |
+| defectdojo.authentication.userSecret | string | `"defectdojo-credentials"` | Link a pre-existing generic secret with `username` and `apikey` key / value pairs |
+| defectdojo.authentication.usernameKey | string | `"username"` | Name of the username key in the `userSecret` secret. Use this if you already have a secret with different key / value pairs |
+| defectdojo.url | string | `"http://defectdojo-django.default.svc"` | Url to the DefectDojo Instance |
+| image.repository | string | `"docker.io/securecodebox/persistence-defectdojo"` | Hook image repository |
+| image.tag | string | `nil` | Container image tag |