-
Notifications
You must be signed in to change notification settings - Fork 179
Added DefectDojo Hook Support for all secureCodeBox Scanners #487
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
ee6caa8
Integrate generic DD Json Parser
JohannesZahn 73a40b2
Add unit tests
JohannesZahn d6194b8
Bugfix unit tests by adding timestamp attribute
JohannesZahn ec852c1
cover extended iso 8601 date format in unit tests
JohannesZahn 2badbaa
Merge branch 'main' into integrate-generic-dd-parser
JohannesZahn 9386d88
parse findings attributes into defectdojo description
JohannesZahn 80aa2d4
Merge branch 'main' into integrate-generic-dd-parser
rfelber 796f002
apply requested changes
JohannesZahn 94d5124
Merge branch 'main' into integrate-generic-dd-parser
JohannesZahn File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
97 changes: 97 additions & 0 deletions
97
...in/java/io/securecodebox/persistence/mapping/SecureCodeBoxFindingsToDefectDojoMapper.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| package io.securecodebox.persistence.mapping; | ||
|
|
||
| import com.fasterxml.jackson.core.JsonProcessingException; | ||
| import com.fasterxml.jackson.core.type.TypeReference; | ||
| import com.fasterxml.jackson.databind.DeserializationFeature; | ||
| import com.fasterxml.jackson.databind.ObjectMapper; | ||
| import com.fasterxml.jackson.databind.ObjectWriter; | ||
| import com.fasterxml.jackson.databind.node.ArrayNode; | ||
| import com.fasterxml.jackson.databind.node.ObjectNode; | ||
| import io.securecodebox.persistence.models.DefectDojoImportFinding; | ||
| import io.securecodebox.persistence.models.SecureCodeBoxFinding; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import java.io.IOException; | ||
| import java.net.URI; | ||
| import java.time.*; | ||
| import java.time.format.DateTimeFormatter; | ||
| import java.util.*; | ||
|
|
||
| public class SecureCodeBoxFindingsToDefectDojoMapper { | ||
| private static final Logger LOG = LoggerFactory.getLogger(SecureCodeBoxFindingsToDefectDojoMapper.class); | ||
| private static final DateTimeFormatter dtf = DateTimeFormatter.ofPattern("yyyy-MM-dd"); | ||
| private static final ObjectWriter prettyJSONPrinter = new ObjectMapper().writerWithDefaultPrettyPrinter(); | ||
|
|
||
| /** | ||
| * Converts a SecureCodeBox Findings JSON String to a DefectDojo Findings JSON String. | ||
| * @param scbFindingsJson SecureCodeBox Findings JSON File as String | ||
| * @return DefectDojo Findings JSON File as String, compatible with the DefectDojo Generic JSON Parser | ||
| * @throws IOException | ||
| */ | ||
| public static String fromSecureCodeboxFindingsJson(String scbFindingsJson) throws IOException { | ||
| LOG.debug("Converting SecureCodeBox Findings to DefectDojo Findings"); | ||
JohannesZahn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| ObjectMapper mapper = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false); | ||
| List<DefectDojoImportFinding> DefectDojoImportFindings = new ArrayList<>(); | ||
| List<SecureCodeBoxFinding> secureCodeBoxFindings = mapper.readValue(scbFindingsJson, new TypeReference<>() {}); | ||
| for (SecureCodeBoxFinding secureCodeBoxFinding : secureCodeBoxFindings){ | ||
| DefectDojoImportFindings.add(fromSecureCodeBoxFinding(secureCodeBoxFinding)); | ||
| } | ||
| // create the result where the format has to be {"findings": [finding1, findings2, ...]} | ||
| ObjectNode ddFindingJson = mapper.createObjectNode(); | ||
| ArrayNode arrayNode = mapper.valueToTree(DefectDojoImportFindings); | ||
| ddFindingJson.putArray("findings").addAll(arrayNode); | ||
| return ddFindingJson.toString(); | ||
| } | ||
|
|
||
| /** | ||
| * Converts a SecureCodeBox Finding to a DefectDojo Finding, | ||
| * that can be imported by the DefectDojo Generic JSON Parser. | ||
| * @param secureCodeBoxFinding Finding in SecureCodeBox format. | ||
| * @return Finding in DefectDojo Format, compatible with the DefectDojo Generic JSON Parser | ||
| * @throws JsonProcessingException | ||
| */ | ||
| protected static DefectDojoImportFinding fromSecureCodeBoxFinding(SecureCodeBoxFinding secureCodeBoxFinding) throws JsonProcessingException { | ||
JohannesZahn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| //set basic info | ||
| DefectDojoImportFinding result = new DefectDojoImportFinding(); | ||
| result.setTitle(secureCodeBoxFinding.getName()); | ||
| result.setSeverity(capitalize(secureCodeBoxFinding.getSeverity().toString())); | ||
| result.setUniqueIdFromTool(secureCodeBoxFinding.getId()); | ||
|
|
||
| // set Description as combination of finding description and finding attributes | ||
| String description = secureCodeBoxFinding.getDescription(); | ||
| if (secureCodeBoxFinding.getAttributes()!=null) { | ||
| String attributesJson = prettyJSONPrinter.writeValueAsString(secureCodeBoxFinding.getAttributes()); | ||
| description = description + "\n " + attributesJson; | ||
| } | ||
| result.setDescription(description); | ||
|
|
||
| //set finding date | ||
| Instant instant; | ||
| if (secureCodeBoxFinding.getTimestamp() != null) { | ||
| instant = Instant.from(DateTimeFormatter.ISO_INSTANT.parse(secureCodeBoxFinding.getTimestamp())); | ||
| } | ||
| else { | ||
| instant = Instant.now(); | ||
| } | ||
| LocalDateTime localDateTime = LocalDateTime.ofInstant(instant, ZoneId.systemDefault()); | ||
| result.setDate(dtf.format(localDateTime)); | ||
|
|
||
| //set finding location | ||
| try { | ||
| URI.create(secureCodeBoxFinding.getLocation()); | ||
| result.setEndpoints(Collections.singletonList(secureCodeBoxFinding.getLocation())); | ||
| } catch (IllegalArgumentException e) { | ||
| LOG.warn("Couldn't parse the secureCodeBox location, because it: {} s not a vailid uri: {}", e, secureCodeBoxFinding.getLocation()); | ||
| } | ||
| return result; | ||
| } | ||
|
|
||
| private static String capitalize(String str) { | ||
| if(str == null || str.isEmpty()) { | ||
| return str; | ||
| } | ||
|
|
||
| return str.substring(0, 1).toUpperCase() + str.substring(1); | ||
| } | ||
| } | ||
67 changes: 67 additions & 0 deletions
67
...defectdojo/src/main/java/io/securecodebox/persistence/models/DefectDojoImportFinding.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| package io.securecodebox.persistence.models; | ||
|
|
||
| import com.fasterxml.jackson.annotation.JsonIgnoreProperties; | ||
| import com.fasterxml.jackson.annotation.JsonInclude; | ||
| import com.fasterxml.jackson.annotation.JsonProperty; | ||
| import com.fasterxml.jackson.databind.JsonNode; | ||
| import lombok.AllArgsConstructor; | ||
| import lombok.Builder; | ||
| import lombok.Data; | ||
| import lombok.NoArgsConstructor; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| /** | ||
| * DefectDojo JSON Import Format | ||
| * It is used to generate JSON that can be read by the DefectDojo Generic JSON Parser | ||
| */ | ||
| @Data | ||
| @NoArgsConstructor | ||
| @Builder | ||
| @AllArgsConstructor | ||
| @JsonInclude(JsonInclude.Include.NON_NULL) | ||
| public class DefectDojoImportFinding { | ||
|
|
||
| @JsonProperty | ||
| String title; | ||
|
|
||
| @JsonProperty | ||
| String description; | ||
|
|
||
| @JsonProperty | ||
| Boolean active; | ||
|
|
||
| @JsonProperty() | ||
| Boolean verified; | ||
|
|
||
| @JsonProperty | ||
| String severity; | ||
|
|
||
| @JsonProperty | ||
| String impact; | ||
|
|
||
| @JsonProperty | ||
| String date; | ||
|
|
||
| @JsonProperty | ||
| String cve; | ||
|
|
||
| @JsonProperty | ||
| Integer cwe; | ||
|
|
||
| @JsonProperty | ||
| String cvssv3; | ||
|
|
||
| @JsonProperty | ||
| List<String> tags; | ||
|
|
||
| @JsonProperty("unique_id_from_tool") | ||
| String uniqueIdFromTool; | ||
|
|
||
| @JsonProperty("vuln_id_from_tool") | ||
| String vulnIdFromTool; | ||
|
|
||
| @JsonProperty("endpoints") | ||
| List<String> endpoints; | ||
|
|
||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.